nexrall-code 0.5.167 → 0.5.169

package/dist/index.js

@@ -11355,7 +11355,7 @@ var require_memory = __commonJS({
     }();
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.AGENT_MEMORY_MAX_BYTES = exports2.AGENT_MEMORY_INJECT_MAX = exports2.MEMORY_ARCHIVE_MAX_BYTES = exports2.MEMORY_HARD_CAP_BYTES = exports2.MEMORY_COMPACT_TRIGGER_BYTES = exports2.MEMORY_MAX_BYTES = exports2.MEMORY_ENTRY_MAX_CHARS = void 0;
-    exports2.memoryFilePath = memoryFilePath;
+    exports2.memoryFilePath = memoryFilePath2;
     exports2.writeMemory = writeMemory2;
     exports2.readMemory = readMemory2;
     exports2.readAllMemory = readAllMemory2;
@@ -11374,7 +11374,7 @@ var require_memory = __commonJS({
     var crypto9 = __importStar(__require("crypto"));
     var MEMORY_ROOT = process.env.NEXRALL_MEMORY_DIR || path28.join(os17.homedir(), ".nexrall", "memory");
     var GLOBAL_FILE = path28.join(MEMORY_ROOT, "global.md");
-    function memoryFilePath(scope, workDir) {
+    function memoryFilePath2(scope, workDir) {
       if (scope === "global" || !workDir)
         return GLOBAL_FILE;
       const key = crypto9.createHash("sha1").update(path28.resolve(workDir)).digest("hex").slice(0, 16);
@@ -11468,7 +11468,7 @@ ${SUPERSEDED_HEADER}
         trimmed = trimmed.slice(0, budget - 1).trimEnd() + "\u2026";
       }
       const body = prefix2 && budget > 0 ? prefix2 + trimmed : trimmed;
-      const file = memoryFilePath(scope, workDir);
+      const file = memoryFilePath2(scope, workDir);
       return withLock(file, async () => {
         const existing = readMemoryFile(file);
         let { active, archived } = parseSections(existing);
@@ -11503,7 +11503,7 @@ ${SUPERSEDED_HEADER}
       });
     }
     function readMemory2(scope, workDir, opts = {}) {
-      const file = memoryFilePath(scope, workDir);
+      const file = memoryFilePath2(scope, workDir);
       const { active, archived } = parseSections(readMemoryFile(file));
       if (!opts.includeArchived)
         return active.length ? serializeSections(active, []).trim() : "";
@@ -11524,14 +11524,14 @@ ${projMem}`);
       return parts.join("\n\n");
     }
     function clearMemory2(scope, workDir) {
-      const file = memoryFilePath(scope, workDir);
+      const file = memoryFilePath2(scope, workDir);
       try {
         fs28.rmSync(file, { force: true });
       } catch {
       }
     }
     function memoryStats2(scope, workDir) {
-      const file = memoryFilePath(scope, workDir);
+      const file = memoryFilePath2(scope, workDir);
       const content = readMemoryFile(file);
       const { active, archived } = parseSections(content);
       return {
@@ -11545,7 +11545,7 @@ ${projMem}`);
       return reply.split("\n").map((l2) => l2.trimEnd()).filter((l2) => /^-\s\[\d{4}-\d{2}-\d{2}\]\s*\S/.test(l2));
     }
     async function compactMemoryIfNeeded2(scope, workDir, summarize) {
-      const file = memoryFilePath(scope, workDir);
+      const file = memoryFilePath2(scope, workDir);
       return withLock(file, async () => {
         const content = readMemoryFile(file);
         if (Buffer.byteLength(content, "utf-8") <= exports2.MEMORY_COMPACT_TRIGGER_BYTES)
@@ -106910,8 +106910,11 @@ var require_loop = __commonJS({
     }();
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.VERIFY_CMD_RE = exports2.WRITE_TOOL_NAMES = exports2.ToolNotAllowedError = exports2.AGENT_MEMORY_TOOL_SCHEMA = exports2.AGENT_MEMORY_TOOL = exports2._stallLimits = exports2._emptyTurnRetry = exports2.bashNeedsRepoLock = void 0;
+    exports2.loadHooks = loadHooks;
+    exports2.parsePromptHookReply = parsePromptHookReply;
+    exports2.classifyStopFailure = classifyStopFailure;
     exports2.runLifecycleHooks = runLifecycleHooks;
-    exports2.runPermissionRequestHooks = runPermissionRequestHooks2;
+    exports2.runPermissionRequestHooks = runPermissionRequestHooks3;
     exports2.fireNotificationHooks = fireNotificationHooks2;
     exports2.fireManualPostCompactHook = fireManualPostCompactHook2;
     exports2.fireManualPreCompactHook = fireManualPreCompactHook2;
@@ -107027,8 +107030,42 @@ var require_loop = __commonJS({
           ...extra
         ];
       }
+      for (const phase of ENTRY_LIST_PHASES) {
+        const list = merged[phase];
+        if (Array.isArray(list) && list.length) {
+          merged[phase] = toHookEntries(list);
+        }
+      }
       return merged;
     }
+    var ENTRY_LIST_PHASES = [
+      "PreToolUse",
+      "PostToolUse",
+      "SessionStart",
+      "UserPromptSubmit",
+      "PreCompact",
+      "PermissionRequest",
+      "Notification",
+      "PostToolUseFailure",
+      "SubagentStart",
+      "PostCompact",
+      "SessionEnd",
+      "FileChanged",
+      "InstructionsLoaded",
+      "StopFailure"
+    ];
+    function toHookEntries(list) {
+      return list.map((it) => {
+        const e2 = it;
+        if (Array.isArray(e2.hooks))
+          return { matcher: e2.matcher, hooks: e2.hooks };
+        const { matcher, ...rest } = e2;
+        const hook = { ...rest };
+        if (!isKnownHandlerType(hook.type))
+          hook.type = "command";
+        return { matcher, hooks: [hook] };
+      });
+    }
     function spawnHook(command, opts) {
       return new Promise((resolve11) => {
         let stdout = "";
@@ -107098,8 +107135,206 @@ var require_loop = __commonJS({
     async function runHookHandler(hook, payload, opts) {
       if (hook.type === "http")
         return httpHook(hook, payload, opts.timeoutMs);
+      if (hook.type === "prompt" || hook.type === "agent") {
+        return promptHook(hook, payload, { ...opts, envCtx: opts.hookEnv });
+      }
       return spawnHook(String(hook.command ?? ""), { cwd: opts.cwd, timeout: opts.timeoutMs, input: payload, env: opts.env });
     }
+    var HOOK_AGENT_TOOLS = [
+      {
+        name: "read_file",
+        description: "Read a file from the working directory.",
+        input_schema: {
+          type: "object",
+          properties: {
+            path: { type: "string", description: "File path, relative to the working directory." },
+            offset: { type: "number", description: "0-based line to start from." },
+            limit: { type: "number", description: "Maximum number of lines." }
+          },
+          required: ["path"]
+        }
+      },
+      {
+        name: "search_files",
+        description: "Search file contents (regex) or find files by name in the working directory.",
+        input_schema: {
+          type: "object",
+          properties: {
+            pattern: { type: "string", description: "Regex or literal string to search for." },
+            path: { type: "string", description: "Directory to search in." },
+            type: { type: "string", description: "files (paths only) | content (matching lines) | filename." }
+          },
+          required: ["pattern"]
+        }
+      },
+      {
+        name: "list_directory",
+        description: "List the files and directories at a path.",
+        input_schema: { type: "object", properties: { path: { type: "string" } } }
+      },
+      {
+        name: "glob",
+        description: 'Find files matching a glob pattern, e.g. "**/*.ts".',
+        input_schema: { type: "object", properties: { pattern: { type: "string" }, path: { type: "string" } }, required: ["pattern"] }
+      }
+    ];
+    var NO_TOOLS_MARKER = "\0hook-no-tools";
+    function parsePromptHookReply(reply) {
+      const text = String(reply ?? "");
+      const start = text.indexOf("{");
+      const end = text.lastIndexOf("}");
+      if (start < 0 || end <= start)
+        return null;
+      try {
+        const j = JSON.parse(text.slice(start, end + 1));
+        if (typeof j.ok !== "boolean" && typeof j.decision !== "string")
+          return null;
+        return {
+          ok: typeof j.ok === "boolean" ? j.ok : void 0,
+          reason: typeof j.reason === "string" ? j.reason : void 0,
+          additionalContext: typeof j.additionalContext === "string" ? j.additionalContext : void 0,
+          decision: typeof j.decision === "string" ? j.decision : void 0
+        };
+      } catch {
+        return null;
+      }
+    }
+    var PROMPT_HOOK_RULES = `You are a hook evaluator for a coding agent. The hook input JSON is given below, followed by the hook's own instruction. Decide whether the agent action described in the input should proceed. Reply with ONLY one JSON object and nothing else: {"ok":true} to allow, or {"ok":false,"reason":"short explanation"} to block.`;
+    async function promptHook(hook, payload, opts) {
+      const instruction = String(hook.prompt ?? "");
+      if (!instruction)
+        return { status: 1, stdout: "", stderr: 'prompt hook has no "prompt"' };
+      const body = instruction.replace(/\\\$ARGUMENTS/g, "
").replace(/\$ARGUMENTS/g, payload).replace(/\u0001/g, "$ARGUMENTS");
+      const ctl = { aborted: false };
+      const timer = setTimeout(() => {
+        ctl.aborted = true;
+      }, Math.max(1e3, opts.timeoutMs));
+      const outerPoll = opts.abortSignal ? setInterval(() => {
+        if (opts.abortSignal?.aborted)
+          ctl.aborted = true;
+      }, 100) : void 0;
+      if (opts.abortSignal?.aborted) {
+        clearTimeout(timer);
+        if (outerPoll)
+          clearInterval(outerPoll);
+        return { status: 1, stdout: "", stderr: "aborted" };
+      }
+      try {
+        return await runModel();
+      } finally {
+        clearTimeout(timer);
+        if (outerPoll)
+          clearInterval(outerPoll);
+      }
+      async function runModel() {
+        const messages = [{
+          role: "user",
+          content: [{ type: "text", text: `${PROMPT_HOOK_RULES}
+
+Hook input:
+${payload}
+
+Hook instruction:
+${body}` }]
+        }];
+        const isAgent = hook.type === "agent";
+        try {
+          let replyText = "";
+          for (let round = 0; round < (isAgent ? 6 : 1); round++) {
+            const msg = await (0, client_1.streamChat)(messages, {
+              model: hook.model ?? opts.model ?? "turbo",
+              env: opts.envCtx ?? { cwd: opts.cwd },
+              abortSignal: ctl,
+              // Wire the tools by allowlist rather than a separate channel: the backend
+              // filters builtins+extra against it, so an agent hook sees ONLY the four
+              // read-only tools and a prompt hook sees none (the marker matches nothing).
+              toolAllowlist: isAgent ? HOOK_AGENT_TOOLS.map((t2) => t2.name) : [NO_TOOLS_MARKER],
+              extraTools: isAgent ? HOOK_AGENT_TOOLS : void 0
+            }, () => {
+            });
+            const blocks = Array.isArray(msg.content) ? msg.content : [];
+            const toolUses = blocks.filter((b) => b.type === "tool_use");
+            if (!toolUses.length || !isAgent) {
+              replyText = blocks.filter((b) => b.type === "text" && typeof b.text === "string").map((b) => b.text).join("\n");
+              break;
+            }
+            messages.push({ role: "assistant", content: msg.content });
+            const results = [];
+            for (const tu of toolUses) {
+              let out;
+              try {
+                out = getHookToolExecutors().includes(String(tu.name)) ? await (0, executor_1.executeTool)(String(tu.name), tu.input ?? {}, ctl, void 0, opts.cwd) : { error: `Tool ${String(tu.name)} is not available to a hook \u2014 only ${getHookToolExecutors().join(", ")}.` };
+              } catch (err) {
+                out = { error: err.message || "tool failed" };
+              }
+              results.push({
+                type: "tool_result",
+                tool_use_id: String(tu.id),
+                content: out.error ? out.output ? `Error: ${out.error}
+
+${out.output}` : `Error: ${out.error}` : out.output ?? "",
+                is_error: out.error !== void 0
+              });
+            }
+            messages.push({ role: "user", content: results });
+          }
+          const parsed = parsePromptHookReply(replyText);
+          if (!parsed) {
+            return { status: 1, stdout: "", stderr: "prompt hook returned no decision" };
+          }
+          const decided = parsed.ok === false || parsed.decision === "block" || parsed.decision === "deny";
+          if (decided)
+            return { status: 2, stdout: "", stderr: parsed.reason || `Blocked by ${hook.type} hook` };
+          const passthrough2 = parsed.additionalContext ? JSON.stringify({ additionalContext: parsed.additionalContext }) : "";
+          return { status: 0, stdout: passthrough2, stderr: "" };
+        } catch (err) {
+          if (ctl.aborted)
+            return { status: 1, stdout: "", stderr: "prompt hook timed out" };
+          return { status: 1, stdout: "", stderr: `prompt hook failed: ${err.message}` };
+        }
+      }
+    }
+    function getHookToolExecutors() {
+      return ["read_file", "search_files", "list_directory", "glob"];
+    }
+    function hookRunOptsFor(options) {
+      return { model: options.model ?? "turbo", abortSignal: options.abortSignal, hookEnv: options.env };
+    }
+    function classifyStopFailure(err) {
+      const status = err?.status;
+      const code = err?.code;
+      const details = [status ? `HTTP ${status}` : "", code ? String(code) : ""].filter(Boolean).join(" ") || void 0;
+      if (status === 429)
+        return { error: "rate_limit", error_details: details };
+      if (status === 529)
+        return { error: "overloaded", error_details: details };
+      if (status === 401)
+        return { error: "authentication_failed", error_details: details };
+      if (status === 402)
+        return { error: "billing_error", error_details: details };
+      if (status === 403)
+        return { error: "authentication_failed", error_details: details };
+      if (status === 400 || status === 422)
+        return { error: "invalid_request", error_details: details };
+      if (status === 404)
+        return { error: "model_not_found", error_details: details };
+      if (typeof status === "number" && status >= 500)
+        return { error: "server_error", error_details: details };
+      return { error: "unknown", error_details: details };
+    }
+    function apiFailureForStopReason(stopReason) {
+      if (stopReason === "output-limit")
+        return { error: "max_output_tokens" };
+      if (stopReason === "no-balance")
+        return { error: "billing_error", error_details: "wallet empty (402)" };
+      if (stopReason === "no-team-budget")
+        return { error: "billing_error", error_details: "team pool empty (402)" };
+      if (stopReason === "reported-elsewhere")
+        return { error: "billing_error", error_details: "pre-flight 402" };
+      if (stopReason === "team-unavailable")
+        return { error: "account_on_hold", error_details: "team billing unusable (403)" };
+      return null;
+    }
     function hookTimeoutMs(hook, fallbackMs = 6e4) {
       if (typeof hook.timeout_ms === "number" && hook.timeout_ms > 0)
         return Math.min(hook.timeout_ms, 6e5);
@@ -107115,7 +107350,7 @@ var require_loop = __commonJS({
         return norm === toolName || norm === alt && toolName.includes(alt);
       });
     }
-    async function runToolHooks(entries, phase, toolName, input, workDir, result) {
+    async function runToolHooks(entries, phase, toolName, input, workDir, result, hookOpts) {
       const outcome = { block: false };
       if (!entries?.length)
         return outcome;
@@ -107129,11 +107364,7 @@ var require_loop = __commonJS({
         if (!hookMatches(entry.matcher, toolName))
           continue;
         for (const hook of entry.hooks ?? []) {
-          if (hook.type !== "command" && hook.type !== "http")
-            continue;
-          if (hook.type === "command" && !hook.command)
-            continue;
-          if (hook.type === "http" && !hook.url)
+          if (!isRunnableHook(hook))
             continue;
           const hookTimeout = hookTimeoutMs(hook, 6e4);
           const r2 = await runHookHandler(hook, payload, {
@@ -107144,7 +107375,8 @@ var require_loop = __commonJS({
               NEXRALL_TOOL_NAME: toolName,
               NEXRALL_TOOL_INPUT: JSON.stringify(input),
               NEXRALL_HOOK_PHASE: phase
-            }
+            },
+            ...hookOpts
           });
           const out = (r2.stdout ?? "").toString().trim();
           if (out.startsWith("{")) {
@@ -107169,17 +107401,13 @@ var require_loop = __commonJS({
       }
       return outcome;
     }
-    async function runSimpleHooks(defs, workDir, extraEnv) {
+    async function runSimpleHooks(defs, workDir, extraEnv, hookOpts) {
       if (!defs?.length)
         return;
       for (const hook of defs) {
-        if (hook.type !== "command" && hook.type !== "http")
+        if (!isRunnableHook(hook))
           continue;
-        if (hook.type === "command" && !hook.command)
-          continue;
-        if (hook.type === "http" && !hook.url)
-          continue;
-        await runHookHandler(hook, "", { cwd: workDir, timeoutMs: hookTimeoutMs(hook, 1e4), env: extraEnv ? { ...process.env, ...extraEnv } : void 0 });
+        await runHookHandler(hook, "", { cwd: workDir, timeoutMs: hookTimeoutMs(hook, 1e4), env: extraEnv ? { ...process.env, ...extraEnv } : void 0, ...hookOpts });
       }
     }
     function flattenHookDefs(items, matchValue) {
@@ -107190,26 +107418,34 @@ var require_loop = __commonJS({
           if (m2 && m2 !== "*" && matchValue !== void 0 && !m2.split("|").map((x2) => x2.trim()).includes(matchValue))
             continue;
           out.push(...it.hooks);
-        } else if (it && (it.type === "command" || it.type === "http"))
+        } else if (it && isKnownHandlerType(it.type))
           out.push(it);
       }
       return out;
     }
-    async function runLifecycleHooks(items, event, workDir, payload, matchValue) {
+    function isKnownHandlerType(t2) {
+      return t2 === "command" || t2 === "http" || t2 === "prompt" || t2 === "agent";
+    }
+    function isRunnableHook(hook) {
+      if (!isKnownHandlerType(hook.type))
+        return false;
+      if (hook.type === "command")
+        return !!hook.command;
+      if (hook.type === "http")
+        return !!hook.url;
+      return !!hook.prompt;
+    }
+    async function runLifecycleHooks(items, event, workDir, payload, matchValue, hookOpts) {
       const outcome = { block: false };
       const defs = flattenHookDefs(items, matchValue);
       if (!defs.length)
         return outcome;
       const input = JSON.stringify({ hook_event_name: event, cwd: workDir, ...payload });
       for (const hook of defs) {
-        if (hook.type !== "command" && hook.type !== "http")
-          continue;
-        if (hook.type === "command" && !hook.command)
-          continue;
-        if (hook.type === "http" && !hook.url)
+        if (!isRunnableHook(hook))
           continue;
-        const timeout = hookTimeoutMs(hook, 3e4);
-        const r2 = await runHookHandler(hook, input, { cwd: workDir, timeoutMs: timeout, env: { ...process.env, NEXRALL_HOOK_PHASE: event } });
+        const timeout = hookTimeoutMs(hook, hook.type === "agent" ? 6e4 : hook.type === "prompt" ? 3e4 : 3e4);
+        const r2 = await runHookHandler(hook, input, { cwd: workDir, timeoutMs: timeout, env: { ...process.env, NEXRALL_HOOK_PHASE: event }, ...hookOpts });
         const out = (r2.stdout ?? "").toString().trim();
         if (out.startsWith("{")) {
           try {
@@ -107229,6 +107465,10 @@ var require_loop = __commonJS({
             }
             if (typeof j.additionalContext === "string" && j.additionalContext)
               outcome.context = (outcome.context ? outcome.context + "\n" : "") + j.additionalContext;
+            if (event === "FileChanged" && Array.isArray(j.watchPaths))
+              outcome.watchPaths = j.watchPaths.filter((p) => typeof p === "string");
+            if (typeof j.systemMessage === "string" && j.systemMessage)
+              outcome.systemMessage = j.systemMessage;
           } catch {
           }
         } else if (out && (event === "SessionStart" || event === "UserPromptSubmit") && r2.status === 0) {
@@ -107241,7 +107481,7 @@ var require_loop = __commonJS({
       }
       return outcome;
     }
-    async function runPermissionRequestHooks2(workDir, tool, input, sessionId = "") {
+    async function runPermissionRequestHooks3(workDir, tool, input, sessionId = "") {
       try {
         const items = loadHooks(workDir).PermissionRequest;
         if (!items?.length)
@@ -108089,7 +108329,7 @@ ${stats}${isoNote}`;
           const subAgentName = agent?.name ?? (typeof input.subagent_type === "string" && input.subagent_type ? input.subagent_type : "general-purpose");
           const startItems = loadHooks(options.workDir).SubagentStart;
           if (startItems?.length) {
-            const o = await runLifecycleHooks(startItems, "SubagentStart", options.workDir, { session_id: options.sessionId ?? "", agent_type: subAgentName, description: String(input.description ?? "") }, subAgentName).catch(() => ({ block: false }));
+            const o = await runLifecycleHooks(startItems, "SubagentStart", options.workDir, { session_id: options.sessionId ?? "", agent_type: subAgentName, description: String(input.description ?? "") }, subAgentName, hookRunOptsFor(options)).catch(() => ({ block: false }));
             if (o.context) {
               const last = subMessages[subMessages.length - 1];
               if (last && Array.isArray(last.content)) {
@@ -108649,7 +108889,7 @@ Do NOT call any tools and do NOT continue the task. Reply with text only: a conc
       if (cut < 2)
         return false;
       if ((options._depth ?? 0) === 0) {
-        await runLifecycleHooks(loadHooks(options.workDir).PreCompact, "PreCompact", options.workDir, { trigger: "auto", session_id: options.sessionId ?? "", messages_to_summarize: cut }, "auto").catch(() => void 0);
+        await runLifecycleHooks(loadHooks(options.workDir).PreCompact, "PreCompact", options.workDir, { trigger: "auto", session_id: options.sessionId ?? "", messages_to_summarize: cut }, "auto", hookRunOptsFor(options)).catch(() => void 0);
       }
       const beforeCompact = messages.length;
       const afterCompact = cut > 0 ? messages.length - cut + 1 : messages.length;
@@ -108662,7 +108902,7 @@ Do NOT call any tools and do NOT continue the task. Reply with text only: a conc
           options.onCompact?.({ trigger: "auto", before: beforeCompact, after: afterCompact });
         } catch {
         }
-        await runLifecycleHooks(loadHooks(options.workDir).PostCompact, "PostCompact", options.workDir, { trigger: "auto", session_id: options.sessionId ?? "", messages_summarized: cut }, "auto").catch(() => void 0);
+        await runLifecycleHooks(loadHooks(options.workDir).PostCompact, "PostCompact", options.workDir, { trigger: "auto", session_id: options.sessionId ?? "", messages_summarized: cut }, "auto", hookRunOptsFor(options)).catch(() => void 0);
       };
       const originalTask = originalTaskText(toSummarize);
       const summaryPrompt = `Summarize this coding-session transcript into concise bullet points the assistant needs to continue the work: key decisions, files changed (and how), commands run, unresolved problems, and user preferences. Max 400 words.
@@ -108910,6 +109150,26 @@ Continue the work from here.` }] });
       const messages = [...initialMessages];
       const model = options.model ?? "turbo";
       const hooks = options.disableHooks ? withAgentHooks({}, options._agentHooks) : withAgentHooks(loadHooks(options.workDir), options._agentHooks);
+      const fireStopFailure = async (failure) => {
+        if (depth !== 0)
+          return;
+        const items = hooks.StopFailure;
+        if (!items?.length)
+          return;
+        let last = "";
+        for (let i2 = messages.length - 1; i2 >= 0 && !last; i2--) {
+          const m2 = messages[i2];
+          if (m2?.role === "assistant" && Array.isArray(m2.content)) {
+            last = m2.content.filter((b) => b.type === "text").map((b) => b.text ?? "").join("\n").trim().slice(0, 2e3);
+          }
+        }
+        await runLifecycleHooks(items, "StopFailure", options.workDir, {
+          session_id: options.sessionId ?? "",
+          error: failure.error,
+          ...failure.error_details ? { error_details: failure.error_details } : {},
+          last_assistant_message: last
+        }, failure.error, hookRunOptsFor(options)).catch(() => void 0);
+      };
       const depth = options._depth ?? 0;
       const agentScope = options._agentScope ?? "root";
       const isMainAgent = depth === 0;
@@ -108930,13 +109190,13 @@ ${ctx}
         const sid = options.sessionId || PROCESS_BUDGET_KEY;
         if (isPrompt && !_sessionStarted.has(sid) && (hooks.SessionStart?.length ?? 0) > 0) {
           _sessionStarted.add(sid);
-          const o = await runLifecycleHooks(hooks.SessionStart, "SessionStart", options.workDir, { session_id: options.sessionId ?? "", source: messages.length > 1 ? "resume" : "startup" }, messages.length > 1 ? "resume" : "startup");
+          const o = await runLifecycleHooks(hooks.SessionStart, "SessionStart", options.workDir, { session_id: options.sessionId ?? "", source: messages.length > 1 ? "resume" : "startup" }, messages.length > 1 ? "resume" : "startup", hookRunOptsFor(options));
           if (o.context)
             addContext(o.context);
         } else if (isPrompt)
           _sessionStarted.add(sid);
         if (isPrompt && (hooks.UserPromptSubmit?.length ?? 0) > 0) {
-          const o = await runLifecycleHooks(hooks.UserPromptSubmit, "UserPromptSubmit", options.workDir, { session_id: options.sessionId ?? "", prompt: promptText });
+          const o = await runLifecycleHooks(hooks.UserPromptSubmit, "UserPromptSubmit", options.workDir, { session_id: options.sessionId ?? "", prompt: promptText }, void 0, hookRunOptsFor(options));
           if (o.block) {
             options.onText(`
 \u26D4 Prompt blocked by a UserPromptSubmit hook: ${o.reason ?? "no reason given"}
@@ -109204,7 +109464,8 @@ ${ctx}
               stopReason = "team-unavailable";
               break;
             }
-            await runSimpleHooks(hooks.OnError, options.workDir);
+            await runSimpleHooks(hooks.OnError, options.workDir, void 0, hookRunOptsFor(options));
+            await fireStopFailure(classifyStopFailure(err));
             throw new types_1.AgentTurnError(`Stream failed: ${err.message}`, trimToResumableBoundary(messages), completedRounds, err);
           }
           if (options.abortSignal?.aborted) {
@@ -109245,7 +109506,7 @@ ${ctx}
               continue;
             }
             if (depth === 0)
-              await runSimpleHooks(hooks.PostMessageComplete, options.workDir);
+              await runSimpleHooks(hooks.PostMessageComplete, options.workDir, void 0, hookRunOptsFor(options));
             stopReason = assistantMessage.stopReason === "max_tokens" ? "output-limit" : "empty-response";
             break;
           }
@@ -109329,13 +109590,14 @@ ${ctx}
               }
             }
             if (depth === 0)
-              await runSimpleHooks(hooks.PostMessageComplete, options.workDir);
+              await runSimpleHooks(hooks.PostMessageComplete, options.workDir, void 0, hookRunOptsFor(options));
             stopReason = "clean";
             break;
           }
           const prefetchSafe = prefetchOn && (0, toolPrefetch_1.isPrefetchSafeMessage)(toolUseBlocks.map((b) => b.name));
           const toolResults = await Promise.all(toolUseBlocks.map(async (block) => {
-            const { id, name, input } = block;
+            const { id, name } = block;
+            let input = block.input;
             const toolMeta = { id };
             options.onToolUse(name, input, void 0, toolMeta);
             let result;
@@ -109366,7 +109628,31 @@ ${ctx}
             let permitted;
             let deniedReason = null;
             try {
-              permitted = await options.requestPermission({ tool: name, input, description });
+              const pd = await options.requestPermission({ tool: name, input, description });
+              if (typeof pd === "boolean") {
+                permitted = pd;
+              } else {
+                permitted = pd.granted;
+                if (permitted && pd.updatedInput && typeof pd.updatedInput === "object") {
+                  input = pd.updatedInput;
+                  if (options.planMode) {
+                    const r2 = (0, planMode_1.checkPlanMode)(name, input);
+                    if (r2) {
+                      permitted = false;
+                      deniedReason = r2.message;
+                    }
+                  }
+                  if (permitted && options.worktree) {
+                    const r2 = (0, worktreeEnforcement_1.checkWorktreeIsolation)(name, input, options.worktree, options.workDir);
+                    if (r2) {
+                      permitted = false;
+                      deniedReason = r2.message;
+                    }
+                  }
+                }
+                if (!permitted && pd.message)
+                  deniedReason = deniedReason ?? pd.message;
+              }
             } catch (err) {
               permitted = false;
               if (err instanceof ToolNotAllowedError)
@@ -109377,12 +109663,12 @@ ${ctx}
             } else if (name === "task") {
               const wantsBackground = input.run_in_background === true || input.run_in_background !== false && !!(0, agentTypes_1.findAgentType)(agentTypes, String(input.subagent_type ?? ""))?.background;
               const taskOptions = { ...auditOptions, _taskToolUseId: id };
-              const preTask = await runToolHooks(hooks.PreToolUse, "PreToolUse", name, input, options.workDir);
+              const preTask = await runToolHooks(hooks.PreToolUse, "PreToolUse", name, input, options.workDir, void 0, hookRunOptsFor(options));
               if (preTask.block) {
                 result = { error: `Blocked by PreToolUse hook: ${preTask.reason}` };
               } else {
                 result = wantsBackground && depth === 0 && options.backgroundAgents && !input.resume_agent_id ? dispatchBackgroundSubAgent(input, taskOptions, agentTypes, options.backgroundAgents) : await dispatchSubAgent(input, taskOptions, agentTypes);
-                const postTask = await runToolHooks(hooks.PostToolUse, "PostToolUse", name, input, options.workDir, result);
+                const postTask = await runToolHooks(hooks.PostToolUse, "PostToolUse", name, input, options.workDir, result, hookRunOptsFor(options));
                 const injectedTask = [preTask.context, postTask.context].filter(Boolean).join("\n");
                 if (injectedTask) {
                   if (result.error !== void 0)
@@ -109399,7 +109685,7 @@ ${ctx}
                 }
               }
             } else {
-              const pre = await runToolHooks(hooks.PreToolUse, "PreToolUse", name, input, options.workDir);
+              const pre = await runToolHooks(hooks.PreToolUse, "PreToolUse", name, input, options.workDir, void 0, hookRunOptsFor(options));
               if (pre.block) {
                 result = { error: `Blocked by PreToolUse hook: ${pre.reason}` };
               } else {
@@ -109445,9 +109731,9 @@ ${ctx}
                   const scope = input.scope === "global" ? "global" : "project";
                   void maybeCompactMemory(scope, options);
                 }
-                const post = await runToolHooks(hooks.PostToolUse, "PostToolUse", name, input, options.workDir, result);
+                const post = await runToolHooks(hooks.PostToolUse, "PostToolUse", name, input, options.workDir, result, hookRunOptsFor(options));
                 if (result.error !== void 0 && (hooks.PostToolUseFailure?.length ?? 0) > 0) {
-                  const f3 = await runLifecycleHooks(hooks.PostToolUseFailure, "PostToolUseFailure", options.workDir, { session_id: options.sessionId ?? "", tool_name: name, tool_input: input, error: String(result.error).slice(0, 4e3) }, name).catch(() => ({ block: false }));
+                  const f3 = await runLifecycleHooks(hooks.PostToolUseFailure, "PostToolUseFailure", options.workDir, { session_id: options.sessionId ?? "", tool_name: name, tool_input: input, error: String(result.error).slice(0, 4e3) }, name, hookRunOptsFor(options)).catch(() => ({ block: false }));
                   if (f3.context)
                     post.context = [post.context, f3.context].filter(Boolean).join("\n");
                   if (f3.block) {
@@ -109569,6 +109855,9 @@ ${result.output}` : `Error: ${result.error}` : result.output ?? "",
           stopReason = "budget";
         if (options.abortSignal?.aborted)
           stopReason = "aborted";
+        const apiFailure = apiFailureForStopReason(stopReason);
+        if (apiFailure)
+          await fireStopFailure(apiFailure);
         const notice = stopReasonNotice(stopReason, { budget, repeatError: stalledRepeatError });
         if (options._onStopReason)
           options._onStopReason(stopReason, notice || null);
@@ -109583,12 +109872,12 @@ ${result.output}` : `Error: ${result.error}` : result.output ?? "",
         throw new types_1.AgentTurnError(err?.message || "The turn ended unexpectedly", trimToResumableBoundary(messages), completedRounds, err);
       } finally {
         if (depth === 0 && (hooks.SessionEnd?.length ?? 0) > 0) {
-          await runLifecycleHooks(hooks.SessionEnd, "SessionEnd", options.workDir, { session_id: options.sessionId ?? "", reason: stopReason }, stopReason).catch(() => void 0);
+          await runLifecycleHooks(hooks.SessionEnd, "SessionEnd", options.workDir, { session_id: options.sessionId ?? "", reason: stopReason }, stopReason, hookRunOptsFor(options)).catch(() => void 0);
         }
         if (depth === 0)
-          await runSimpleHooks(hooks.OnStop, options.workDir);
+          await runSimpleHooks(hooks.OnStop, options.workDir, void 0, hookRunOptsFor(options));
         else
-          await runSimpleHooks(hooks.SubagentStop, options.workDir, { NEXRALL_AGENT_NAME: options._agentTypeName ?? "general-purpose" });
+          await runSimpleHooks(hooks.SubagentStop, options.workDir, { NEXRALL_AGENT_NAME: options._agentTypeName ?? "general-purpose" }, hookRunOptsFor(options));
       }
       return messages;
     }
@@ -109610,6 +109899,251 @@ ${result.output}` : `Error: ${result.error}` : result.output ?? "",
   }
 });
 
+// ../core/dist/agent/lifecycleHost.js
+var require_lifecycleHost = __commonJS({
+  "../core/dist/agent/lifecycleHost.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m2, k, k2) {
+      if (k2 === void 0)
+        k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m2, k);
+      if (!desc || ("get" in desc ? !m2.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m2[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    } : function(o, m2, k, k2) {
+      if (k2 === void 0)
+        k2 = k;
+      o[k2] = m2[k];
+    });
+    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    } : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2)
+            if (Object.prototype.hasOwnProperty.call(o2, k))
+              ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule)
+          return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i2 = 0; i2 < k.length; i2++)
+            if (k[i2] !== "default")
+              __createBinding(result, mod, k[i2]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    }();
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.fireInstructionsLoadedHooks = fireInstructionsLoadedHooks2;
+    exports2.startFileChangedWatcher = startFileChangedWatcher2;
+    exports2.filesChangedSinceSnapshot = filesChangedSinceSnapshot;
+    var fs28 = __importStar(__require("fs"));
+    var path28 = __importStar(__require("path"));
+    var loop_1 = require_loop();
+    async function fireInstructionsLoadedHooks2(workDir, sessionId, files) {
+      if (!files.length)
+        return;
+      try {
+        const items = (0, loop_1.loadHooks)(workDir).InstructionsLoaded;
+        if (!items?.length)
+          return;
+        for (const f3 of files) {
+          await (0, loop_1.runLifecycleHooks)(items, "InstructionsLoaded", workDir, {
+            session_id: sessionId,
+            file_path: f3.file_path,
+            memory_type: f3.memory_type,
+            load_reason: f3.load_reason,
+            ...f3.globs ? { globs: f3.globs } : {}
+          }, f3.load_reason).catch(() => void 0);
+        }
+      } catch {
+      }
+    }
+    function isWatchableName(name) {
+      return !!name && !name.includes("/") && !name.includes("\\") && !name.includes("*") && !name.includes("?") && name !== "." && name !== "..";
+    }
+    function startFileChangedWatcher2(workDir, sessionId, opts) {
+      let items;
+      try {
+        items = (0, loop_1.loadHooks)(workDir).FileChanged;
+      } catch {
+        items = void 0;
+      }
+      if (!items?.length)
+        return null;
+      const staticNames = /* @__PURE__ */ new Set();
+      for (const it of items) {
+        if (it && Array.isArray(it.hooks)) {
+          const m2 = it.matcher;
+          if (!m2 || m2 === "*")
+            continue;
+          for (const raw of m2.split("|")) {
+            const name = raw.trim();
+            if (isWatchableName(name))
+              staticNames.add(name);
+          }
+        }
+      }
+      if (!staticNames.size)
+        return null;
+      const dynamicNames = /* @__PURE__ */ new Set();
+      const watched = () => /* @__PURE__ */ new Set([...staticNames, ...dynamicNames]);
+      const known = /* @__PURE__ */ new Set();
+      const seedKnown = (names) => {
+        for (const n of names) {
+          try {
+            if (fs28.existsSync(path28.join(workDir, n)))
+              known.add(n);
+          } catch {
+          }
+        }
+      };
+      seedKnown(staticNames);
+      const stamp = (name) => {
+        try {
+          const st = fs28.statSync(path28.join(workDir, name));
+          return `${st.mtimeMs}:${st.size}`;
+        } catch {
+          return "";
+        }
+      };
+      const seen = /* @__PURE__ */ new Map();
+      const snapshot = (names) => {
+        for (const n of names)
+          seen.set(n, stamp(n));
+      };
+      snapshot(staticNames);
+      const pending = /* @__PURE__ */ new Map();
+      let closed = false;
+      const scheduleFire = (name) => {
+        const prev = pending.get(name);
+        if (prev)
+          clearTimeout(prev);
+        pending.set(name, setTimeout(() => {
+          pending.delete(name);
+          let exists = true;
+          try {
+            exists = fs28.existsSync(path28.join(workDir, name));
+          } catch {
+            exists = false;
+          }
+          const event = !exists ? "unlink" : known.has(name) ? "change" : "add";
+          if (exists)
+            known.add(name);
+          else
+            known.delete(name);
+          seen.set(name, stamp(name));
+          void fireChanged(workDir, sessionId, name, event, items, dynamicNames.has(name)).then((o) => {
+            if (!o)
+              return;
+            if (o.systemMessage && opts?.onSystemMessage) {
+              try {
+                opts.onSystemMessage(o.systemMessage);
+              } catch {
+              }
+            }
+            if (o.watchPaths) {
+              dynamicNames.clear();
+              for (const p of o.watchPaths) {
+                const n = isWatchableName(path28.basename(p)) ? path28.basename(p) : "";
+                if (n)
+                  dynamicNames.add(n);
+              }
+              seedKnown(dynamicNames);
+              snapshot(dynamicNames);
+            }
+          }).catch(() => {
+          });
+        }, 250));
+      };
+      let watcher = null;
+      try {
+        watcher = fs28.watch(workDir, { persistent: false }, (_eventType, filename) => {
+          if (closed)
+            return;
+          const name = filename ? path28.basename(String(filename)) : "";
+          if (!name || !watched().has(name))
+            return;
+          scheduleFire(name);
+        });
+        watcher.on("error", () => {
+        });
+      } catch {
+        return null;
+      }
+      const armGraceMs = opts?.armGraceMs ?? 400;
+      const reconcileTimer = armGraceMs > 0 ? setTimeout(() => {
+        if (closed)
+          return;
+        for (const n of filesChangedSinceSnapshot(watched(), seen, stamp))
+          scheduleFire(n);
+      }, armGraceMs) : null;
+      return {
+        stop() {
+          closed = true;
+          if (reconcileTimer)
+            clearTimeout(reconcileTimer);
+          for (const t2 of pending.values())
+            clearTimeout(t2);
+          pending.clear();
+          try {
+            watcher?.close();
+          } catch {
+          }
+          watcher = null;
+        },
+        updateWatchPaths(paths) {
+          dynamicNames.clear();
+          for (const p of paths) {
+            const n = isWatchableName(path28.basename(p)) ? path28.basename(p) : "";
+            if (n)
+              dynamicNames.add(n);
+          }
+          seedKnown(dynamicNames);
+          snapshot(dynamicNames);
+        },
+        watchedFiles() {
+          return [...watched()].sort();
+        }
+      };
+    }
+    function filesChangedSinceSnapshot(names, seen, stamp) {
+      const out = [];
+      for (const n of names)
+        if (stamp(n) !== (seen.get(n) ?? ""))
+          out.push(n);
+      return out;
+    }
+    async function fireChanged(workDir, sessionId, name, event, items, isDynamic) {
+      const abs = path28.join(workDir, name);
+      try {
+        const o = await (0, loop_1.runLifecycleHooks)(items, "FileChanged", workDir, {
+          session_id: sessionId,
+          file_path: abs,
+          event
+        }, isDynamic ? void 0 : name);
+        return { watchPaths: o.watchPaths, systemMessage: o.systemMessage };
+      } catch {
+        return null;
+      }
+    }
+  }
+});
+
 // ../core/dist/mcp/client.js
 var require_client2 = __commonJS({
   "../core/dist/mcp/client.js"(exports2) {
@@ -111826,6 +112360,7 @@ var require_dist3 = __commonJS({
     __exportStar(require_client(), exports2);
     __exportStar(require_executor(), exports2);
     __exportStar(require_loop(), exports2);
+    __exportStar(require_lifecycleHost(), exports2);
     __exportStar(require_modelCatalogue(), exports2);
     __exportStar(require_testIntegrity(), exports2);
     __exportStar(require_editCompleteness(), exports2);
@@ -145693,7 +146228,7 @@ var {
 } = import_index.default;
 
 // src/index.ts
-var import_code_core20 = __toESM(require_dist3(), 1);
+var import_code_core21 = __toESM(require_dist3(), 1);
 import * as path27 from "path";
 import * as fs27 from "fs";
 import { createRequire as createRequire2 } from "module";
@@ -151602,7 +152137,7 @@ function confirmMatches(env4, typed) {
 }
 
 // src/commands/chat.ts
-var import_code_core16 = __toESM(require_dist3(), 1);
+var import_code_core17 = __toESM(require_dist3(), 1);
 import * as os15 from "os";
 import * as crypto7 from "crypto";
 import { createRequire } from "module";
@@ -152512,8 +153047,82 @@ async function askFlow(req) {
   return await choose({ title: `Allow ${tool}?`, risk: riskOf(tool, input), alwaysLabel: null }) !== "n";
 }
 
-// src/audit.ts
+// src/permissions/promptTool.ts
+function parsePromptToolAnswer(raw) {
+  if (raw === null)
+    return { error: "the permission tool is not connected (check `nex mcp list`)" };
+  const text = String(raw).trim();
+  let j;
+  try {
+    j = JSON.parse(text);
+  } catch {
+    return { error: `the permission tool returned non-JSON: ${text.slice(0, 200) || "(empty)"}` };
+  }
+  if (!j || typeof j !== "object" || Array.isArray(j)) {
+    return { error: `the permission tool returned JSON that is not an object: ${text.slice(0, 200)}` };
+  }
+  const o = j;
+  const behavior = o.behavior === "allow" || o.behavior === "deny" ? o.behavior : o.decision === "allow" || o.decision === "deny" ? o.decision : null;
+  if (!behavior) {
+    return { error: `the permission tool did not return a behavior/decision of "allow" or "deny": ${text.slice(0, 200)}` };
+  }
+  const message = typeof o.message === "string" && o.message ? o.message : typeof o.reason === "string" && o.reason ? o.reason : void 0;
+  if (behavior === "allow" && o.updatedInput !== void 0) {
+    if (!o.updatedInput || typeof o.updatedInput !== "object" || Array.isArray(o.updatedInput)) {
+      return { error: `the permission tool returned an updatedInput that is not an object: ${text.slice(0, 200)}` };
+    }
+    return { behavior, updatedInput: o.updatedInput, message };
+  }
+  return { behavior, message };
+}
+async function askPermissionPromptTool(host, toolName, req, abortSignal) {
+  if (!host)
+    return { error: `--permission-prompt-tool "${toolName}" needs MCP, but no MCP servers are configured for this run` };
+  if (!host.isMcpTool(toolName)) {
+    return { error: `--permission-prompt-tool "${toolName}" is not a tool of any connected MCP server (check \`nex mcp list\`)` };
+  }
+  let raw;
+  try {
+    raw = await host.callTool(toolName, {
+      tool_name: req.tool,
+      input: req.input,
+      ...req.description ? { description: req.description } : {},
+      cwd: req.cwd,
+      permission_mode: req.mode,
+      ...req.sessionId ? { session_id: req.sessionId } : {}
+    }, abortSignal);
+  } catch (err) {
+    return { error: `the permission tool failed: ${err instanceof Error ? err.message : String(err)}` };
+  }
+  return parsePromptToolAnswer(raw);
+}
+
+// src/permissions/headlessHook.ts
 var import_code_core7 = __toESM(require_dist3(), 1);
+async function runHeadlessPermissionHooks(ctx, emit, emitEvent2) {
+  const locked = ctx.policyDeny || ctx.reason === "rule";
+  const destructive = ctx.reason === "destructive" && !!ctx.destructive;
+  if (locked || destructive)
+    return { handled: null };
+  const hook = await (0, import_code_core7.runPermissionRequestHooks)(ctx.workDir, ctx.tool, ctx.input, ctx.sessionId);
+  if (hook.answer === "allow") {
+    emit({ type: "permission_granted", tool: ctx.tool, reason: "hook" });
+    emitEvent2("permission.granted", { tool: ctx.tool, reason: "hook" });
+    return { handled: "allow" };
+  }
+  if (hook.answer === "deny") {
+    emit({ type: "permission_denied", tool: ctx.tool, reason: "hook" });
+    emitEvent2("permission.denied", { tool: ctx.tool, reason: "hook" });
+    return {
+      handled: "deny",
+      message: hook.reason ? `Permission denied by hook: ${hook.reason}` : "Permission denied by hook"
+    };
+  }
+  return { handled: null };
+}
+
+// src/audit.ts
+var import_code_core8 = __toESM(require_dist3(), 1);
 import * as path7 from "path";
 var _state;
 var _sinks = /* @__PURE__ */ new Map();
@@ -152533,7 +153142,7 @@ function currentAudit() {
   const target = resolveAuditPath(_state);
   let sink = _sinks.get(target);
   if (!sink) {
-    sink = (0, import_code_core7.createJsonlAuditSink)(target);
+    sink = (0, import_code_core8.createJsonlAuditSink)(target);
     _sinks.set(target, sink);
   }
   const cfg = {
@@ -152546,14 +153155,14 @@ function currentAudit() {
     // request that caused it. Same trap as @nexrall/agent's and Desktop's.
     sessionId: _state.getSessionId()
   };
-  const email = (0, import_code_core7.loadAuth)()?.email;
+  const email = (0, import_code_core8.loadAuth)()?.email;
   if (email)
     cfg.userId = email;
   return cfg;
 }
 
 // src/commands/chat.ts
-var import_code_core17 = __toESM(require_dist3(), 1);
+var import_code_core18 = __toESM(require_dist3(), 1);
 
 // src/headlessFlags.ts
 import * as fs7 from "fs";
@@ -152699,6 +153308,8 @@ function checkHeadlessOnly(f3) {
     return "--no-session-persistence only works with --output-format (a one-shot, non-interactive run).";
   if (f3.maxTurns !== void 0)
     return "--max-turns only works with --output-format (a one-shot, non-interactive run).";
+  if (f3.permissionPromptTool !== void 0)
+    return "--permission-prompt-tool only works with --output-format (a one-shot, non-interactive run).";
   return null;
 }
 function headlessVerdict(i2) {
@@ -152887,6 +153498,15 @@ function readPromptFile(file, cwd2, flag = "--append-system-prompt-file") {
     return { ok: false, error: `${flag}: "${file}" is empty` };
   return { ok: true, value: text.trim() };
 }
+function normalizePermissionPromptTool(raw) {
+  let name = String(raw).trim();
+  if (name.startsWith("mcp__"))
+    name = name.slice("mcp__".length);
+  if (!name || !name.includes("__")) {
+    return { ok: false, error: `--permission-prompt-tool: "${raw}" is not an MCP tool name. Use mcp__server__tool (the name shown in /mcp or \`nex mcp list\`)` };
+  }
+  return { ok: true, value: name };
+}
 var CLAUDE_TOOL_ALIASES = {
   Read: ["read_file", "list_directory", "search_files", "glob", "notebook_read"],
   Edit: ["edit_file", "multi_edit", "notebook_edit"],
@@ -153093,7 +153713,7 @@ function parseAgentsArg(raw, cwd2) {
 }
 
 // src/commands/chat.ts
-var import_code_core18 = __toESM(require_dist3(), 1);
+var import_code_core19 = __toESM(require_dist3(), 1);
 
 // src/debugLog.ts
 import fs8 from "fs";
@@ -153140,14 +153760,14 @@ function debugLog(event, fields) {
 }
 
 // src/commands/doctor.ts
-var import_code_core9 = __toESM(require_dist3(), 1);
+var import_code_core10 = __toESM(require_dist3(), 1);
 import fs10 from "fs";
 import os4 from "os";
 import path11 from "path";
 import { spawnSync as spawnSync2, execFileSync as execFileSync2 } from "child_process";
 
 // src/commands/sessionTools.ts
-var import_code_core8 = __toESM(require_dist3(), 1);
+var import_code_core9 = __toESM(require_dist3(), 1);
 import { spawnSync, execFileSync } from "child_process";
 import fs9 from "fs";
 import path10 from "path";
@@ -153196,7 +153816,7 @@ function nextMode(current) {
   return MODE_CYCLE[(i2 + 1) % MODE_CYCLE.length];
 }
 function textOf(m2) {
-  return m2.content.filter((b) => b.type === "text" && !(0, import_code_core8.isRuntimeContextBlock)(b)).map((b) => b.text).join("\n").trim();
+  return m2.content.filter((b) => b.type === "text" && !(0, import_code_core9.isRuntimeContextBlock)(b)).map((b) => b.text).join("\n").trim();
 }
 function lastAssistantText(messages) {
   for (let i2 = messages.length - 1; i2 >= 0; i2--) {
@@ -153222,7 +153842,7 @@ function exportMarkdown(messages, meta) {
   for (const m2 of messages) {
     const parts = [];
     for (const b of m2.content) {
-      if ((0, import_code_core8.isRuntimeContextBlock)(b))
+      if ((0, import_code_core9.isRuntimeContextBlock)(b))
         continue;
       if (b.type === "text") {
         if (b.text.trim())
@@ -153580,17 +154200,17 @@ function realProbes(c) {
         return { inRepo: false };
       }
     },
-    hasToken: () => !!(0, import_code_core9.getToken)(),
+    hasToken: () => !!(0, import_code_core10.getToken)(),
     verifyAuth: async () => {
       try {
-        await (0, import_code_core9.getBalance)();
+        await (0, import_code_core10.getBalance)();
         return { ok: true, detail: "signed in, token accepted" };
       } catch (e2) {
         return { ok: false, detail: `token rejected \u2014 ${e2.message.slice(0, 120)}` };
       }
     },
-    reach: () => reachHost(import_code_core9.API_BASE),
-    apiBase: import_code_core9.API_BASE,
+    reach: () => reachHost(import_code_core10.API_BASE),
+    apiBase: import_code_core10.API_BASE,
     isTTY: !!process.stdout.isTTY,
     columns: process.stdout.columns,
     rows: process.stdout.rows,
@@ -153598,7 +154218,7 @@ function realProbes(c) {
     mcp: () => {
       let configured = 0;
       try {
-        configured = Object.keys(import_code_core9.McpManager.loadConfig(c.workDir).mcpServers).length;
+        configured = Object.keys(import_code_core10.McpManager.loadConfig(c.workDir).mcpServers).length;
       } catch {
       }
       return { configured, rows: c.mcpRows ?? [] };
@@ -163456,7 +164076,7 @@ var useBoxMetrics = (ref) => {
 var use_box_metrics_default = useBoxMetrics;
 
 // src/ui/themeSettings.ts
-var import_code_core10 = __toESM(require_dist3(), 1);
+var import_code_core11 = __toESM(require_dist3(), 1);
 import * as fs17 from "fs";
 import * as os9 from "os";
 import * as path17 from "path";
@@ -163490,13 +164110,13 @@ function applyThemeConfig(cfg, opts = {}) {
   return { resolved, notes };
 }
 function applyTrustedTheme(env4 = process.env) {
-  const settings = (0, import_code_core10.loadSettings)(os9.homedir());
+  const settings = (0, import_code_core11.loadSettings)(os9.homedir());
   const cfg = readThemeConfig(settings.raw);
   const { resolved, notes } = applyThemeConfig(cfg, { env: env4 });
   return { ...cfg, resolved, notes };
 }
 function loadAndApplyTheme(workDir, env4 = process.env) {
-  const settings = (0, import_code_core10.loadSettings)(workDir);
+  const settings = (0, import_code_core11.loadSettings)(workDir);
   const cfg = readThemeConfig(settings.raw);
   const { resolved, notes } = applyThemeConfig(cfg, { env: env4 });
   return { ...cfg, resolved, notes };
@@ -167212,7 +167832,7 @@ function orderByRecents(entries, recents) {
 }
 
 // src/ui/memoryNote.ts
-var import_code_core11 = __toESM(require_dist3(), 1);
+var import_code_core12 = __toESM(require_dist3(), 1);
 function stripEscape(line) {
   return line.startsWith("\\#") ? line.slice(1) : line;
 }
@@ -167229,7 +167849,7 @@ function parseMemoryNote(line) {
   return text ? { scope: "project", text } : null;
 }
 async function saveNote(note, workDir) {
-  const r2 = await (0, import_code_core11.writeMemory)(note.text, note.scope, workDir, { source: "cli" });
+  const r2 = await (0, import_code_core12.writeMemory)(note.text, note.scope, workDir, { source: "cli" });
   return { ok: r2.ok, already: r2.already, superseded: r2.superseded === true, scope: r2.scope, file: r2.file, text: note.text };
 }
 function parseMemoryAdd(arg) {
@@ -167251,7 +167871,7 @@ function interpretPrompt(line) {
 }
 
 // src/ui/mcpPanel.ts
-var import_code_core12 = __toESM(require_dist3(), 1);
+var import_code_core13 = __toESM(require_dist3(), 1);
 function parseMcpArgs(arg) {
   const parts = arg.trim().split(/\s+/).filter(Boolean);
   if (parts.length === 0)
@@ -167352,7 +167972,7 @@ function formatMcpDetail(input) {
         const desc = (t2.description ?? "").split("\n")[0].trim();
         const head = `      ${t2.name.padEnd(nameWidth)}`;
         const maxSuffix = Math.max(0, budget - head.length);
-        let suffix = (0, import_code_core12.describeStats)(byTool.get(t2.name));
+        let suffix = (0, import_code_core13.describeStats)(byTool.get(t2.name));
         if (suffix) {
           suffix = `  ${suffix}`;
           if (suffix.length > maxSuffix) {
@@ -167566,9 +168186,9 @@ function planModelSwitch(next, effort, clamp) {
 }
 
 // src/ui/keybindingsStore.ts
-var import_code_core13 = __toESM(require_dist3(), 1);
+var import_code_core14 = __toESM(require_dist3(), 1);
 function loadAndApplyKeybindings(workDir) {
-  const settings = (0, import_code_core13.loadSettings)(workDir);
+  const settings = (0, import_code_core14.loadSettings)(workDir);
   const raw = settings.raw.keybindings;
   const result = parseKeybindings(raw);
   setBindings(result);
@@ -167618,7 +168238,7 @@ function resetKeybindings(workDir, scope = "user") {
   return result;
 }
 function readRawBlock(workDir) {
-  const settings = (0, import_code_core13.loadSettings)(workDir);
+  const settings = (0, import_code_core14.loadSettings)(workDir);
   const raw = settings.raw.keybindings;
   return raw && typeof raw === "object" && !Array.isArray(raw) ? { ...raw } : {};
 }
@@ -167818,7 +168438,7 @@ function formatTaskGraph(input) {
 }
 
 // src/ui/contextPanel.ts
-var import_code_core14 = __toESM(require_dist3(), 1);
+var import_code_core15 = __toESM(require_dist3(), 1);
 var KIND_LABEL2 = {
   tool_result: "tool results",
   reply: "model replies",
@@ -167893,8 +168513,8 @@ function textHead(block) {
 var TOP_DEFAULT = 3;
 var TOP_ALL = 10;
 function measureContext(messages, topN = TOP_DEFAULT) {
-  const bytes = (0, import_code_core14.estimateBodyBytes)(messages);
-  const tokens = (0, import_code_core14.estimateTokensRough)(messages);
+  const bytes = (0, import_code_core15.estimateBodyBytes)(messages);
+  const tokens = (0, import_code_core15.estimateTokensRough)(messages);
   const toolNames = /* @__PURE__ */ new Map();
   const buckets = /* @__PURE__ */ new Map();
   const all = [];
@@ -168074,7 +168694,7 @@ function formatContextPanel(input) {
 }
 
 // src/ui/permDashboard.ts
-var import_code_core15 = __toESM(require_dist3(), 1);
+var import_code_core16 = __toESM(require_dist3(), 1);
 var DASHBOARD_ACTIONS = [
   { group: "Filesystem", label: "read a project file", tool: "read_file", input: { path: "src/app.ts" } },
   { group: "Filesystem", label: "edit a project file", tool: "edit_file", input: { path: "src/app.ts", old_string: "a", new_string: "b" } },
@@ -168105,15 +168725,15 @@ var NOT_A_READ = /* @__PURE__ */ new Set(["todo_write", "use_skill"]);
 function capOf(tool) {
   if (tool === "task")
     return "delegate";
-  if (import_code_core15.BASH_TOOLS.has(tool))
+  if (import_code_core16.BASH_TOOLS.has(tool))
     return "shell";
-  if (import_code_core15.FILE_WRITE_TOOLS.has(tool) || import_code_core15.FILE_MUTATE_TOOLS.has(tool))
+  if (import_code_core16.FILE_WRITE_TOOLS.has(tool) || import_code_core16.FILE_MUTATE_TOOLS.has(tool))
     return "write";
   if (NETWORK_TOOLS.has(tool))
     return "network";
   if (tool === "bash_output" || tool === "kill_shell")
     return "shell";
-  if (import_code_core15.READ_ONLY_TOOLS.has(tool) && !NOT_A_READ.has(tool))
+  if (import_code_core16.READ_ONLY_TOOLS.has(tool) && !NOT_A_READ.has(tool))
     return "read";
   return null;
 }
@@ -168141,19 +168761,19 @@ function capPhrase(caps) {
   return parts.length ? parts.join(", ") : "nothing";
 }
 function explainAction(rules, mode, workDir, action, opts = {}) {
-  const rule = (0, import_code_core15.evaluatePermission)(rules, action.tool, action.input, workDir);
+  const rule = (0, import_code_core16.evaluatePermission)(rules, action.tool, action.input, workDir);
   if (rule === "deny")
     return { mark: "\u2717", reason: "denied by a permission rule" };
-  if ((0, import_code_core15.isDestructiveBash)(action.tool, action.input) && !opts.allowDestructive) {
+  if ((0, import_code_core16.isDestructiveBash)(action.tool, action.input) && !opts.allowDestructive) {
     return { mark: "\u26A0", reason: 'irreversible \u2014 always asks (type "yes")' };
   }
   if (rule === "allow")
     return { mark: "\u2713", reason: "allowed by a permission rule" };
-  const verdict = (0, import_code_core15.decide)({ tool: action.tool, input: action.input, mode, bypass: opts.yolo, destructive: false });
+  const verdict = (0, import_code_core16.decide)({ tool: action.tool, input: action.input, mode, bypass: opts.yolo, destructive: false });
   if (verdict === "allow") {
     if (capOf(action.tool) === "read")
       return { mark: "\u2713", reason: "read-only \u2014 allowed in every mode" };
-    if (import_code_core15.BASH_TOOLS.has(action.tool) && (0, import_code_core15.isReadOnlyBash)(String(action.input.command ?? ""))) {
+    if (import_code_core16.BASH_TOOLS.has(action.tool) && (0, import_code_core16.isReadOnlyBash)(String(action.input.command ?? ""))) {
       return { mark: "\u2713", reason: "read-only command \u2014 allowed in every mode" };
     }
     if (action.tool === "fetch_url" || action.tool === "web_search") {
@@ -168611,7 +169231,7 @@ function agentTypeModel(type, workDir) {
   if (!agentTypeCache || agentTypeCache.workDir !== workDir || now - agentTypeCache.at > 1e3) {
     const models = /* @__PURE__ */ new Map();
     try {
-      for (const t2 of (0, import_code_core16.loadAgentTypesWithWarnings)(workDir).types)
+      for (const t2 of (0, import_code_core17.loadAgentTypesWithWarnings)(workDir).types)
         if (t2.model)
           models.set(t2.name, t2.model);
     } catch {
@@ -168676,13 +169296,13 @@ function agentPanelContext(v, cols, now) {
   }
   let maxConcurrent;
   try {
-    maxConcurrent = (0, import_code_core18.resolveMaxConcurrentSubtasks)((0, import_code_core18.loadSettings)(v.workDir).raw);
+    maxConcurrent = (0, import_code_core19.resolveMaxConcurrentSubtasks)((0, import_code_core19.loadSettings)(v.workDir).raw);
   } catch {
     maxConcurrent = void 0;
   }
   const types3 = (() => {
     try {
-      return (0, import_code_core16.loadAgentTypesWithWarnings)(v.workDir).types.map((t2) => ({
+      return (0, import_code_core17.loadAgentTypesWithWarnings)(v.workDir).types.map((t2) => ({
         name: t2.name,
         description: t2.description,
         ...t2.model ? { model: t2.model } : {},
@@ -168782,7 +169402,7 @@ function printMergeReview(dir, cols) {
 function printTaskGraph(workDir, cols) {
   let tasks = [];
   try {
-    tasks = (0, import_code_core18.listSharedTasks)(workDir);
+    tasks = (0, import_code_core19.listSharedTasks)(workDir);
   } catch (e2) {
     console.log(paint.red("  Could not read the shared task list: " + e2.message));
     return;
@@ -168897,13 +169517,13 @@ var NO_PDF_MODELS = /* @__PURE__ */ new Set([
   ...NO_VISION_MODELS
 ]);
 function needsVisionSidecar(model) {
-  return !(0, import_code_core16.liveSupportsImageInput)(model, !NO_VISION_MODELS.has(model));
+  return !(0, import_code_core17.liveSupportsImageInput)(model, !NO_VISION_MODELS.has(model));
 }
 function needsPdfSidecar(model) {
-  return !(0, import_code_core16.liveSupportsPdfInput)(model, !NO_PDF_MODELS.has(model));
+  return !(0, import_code_core17.liveSupportsPdfInput)(model, !NO_PDF_MODELS.has(model));
 }
 function selectableModelIds() {
-  return (0, import_code_core16.liveSelectableModelIds)() ?? SELECTABLE_MODELS;
+  return (0, import_code_core17.liveSelectableModelIds)() ?? SELECTABLE_MODELS;
 }
 function normaliseModelId(model) {
   const raw = (model ?? "").trim();
@@ -168964,9 +169584,9 @@ var _BACKEND_STYLE_TO_LOCAL = {
 };
 function effortStyleFor(modelId) {
   const id = normaliseModelId(modelId);
-  if ((0, import_code_core16.liveVendorFor)(id) === "Anthropic")
+  if ((0, import_code_core17.liveVendorFor)(id) === "Anthropic")
     return "anthropic";
-  const liveStyle = (0, import_code_core16.liveReasoningEffortStyle)(id);
+  const liveStyle = (0, import_code_core17.liveReasoningEffortStyle)(id);
   if (liveStyle && _BACKEND_STYLE_TO_LOCAL[liveStyle])
     return _BACKEND_STYLE_TO_LOCAL[liveStyle];
   return MODEL_EFFORT_STYLE[id] ?? "anthropic";
@@ -168986,7 +169606,7 @@ function defaultEffortForModel(modelId) {
 }
 function resolveModelLabel(alias) {
   const id = normaliseModelId(alias);
-  return (0, import_code_core16.liveLabelFor)(id, MODEL_LABELS[id] ?? id);
+  return (0, import_code_core17.liveLabelFor)(id, MODEL_LABELS[id] ?? id);
 }
 function tryExec(cmd, cwd2) {
   try {
@@ -169063,22 +169683,39 @@ var tryRead = (p) => {
     return null;
   }
 };
+var lastLoadedInstructions = [];
 function readNexrallMd(workDir) {
+  lastLoadedInstructions = [];
   if (noDiscovery)
     return void 0;
   const parts = [];
-  const memContent = (0, import_code_core16.readAllMemory)(workDir);
-  if (memContent)
+  const noteLoaded = (file, memoryType) => {
+    try {
+      if (fs25.existsSync(file))
+        lastLoadedInstructions.push({ file_path: file, memory_type: memoryType, load_reason: "session_start" });
+    } catch {
+    }
+  };
+  const memContent = (0, import_code_core17.readAllMemory)(workDir);
+  if (memContent) {
     parts.push(memContent);
-  const globalContent = tryRead(path25.join(os15.homedir(), ".nexrall", "nexrall.md"));
-  if (globalContent)
+    noteLoaded((0, import_code_core17.memoryFilePath)("global"), "User");
+    if (workDir)
+      noteLoaded((0, import_code_core17.memoryFilePath)("project", workDir), "Project");
+  }
+  const globalNexrall = path25.join(os15.homedir(), ".nexrall", "nexrall.md");
+  const globalContent = tryRead(globalNexrall);
+  if (globalContent) {
     parts.push(`[Global instructions]
 ${globalContent}`);
+    noteLoaded(globalNexrall, "User");
+  }
   for (const candidate of NEXRALL_MD_CANDIDATES) {
     const content = tryRead(path25.join(workDir, candidate));
     if (content) {
       parts.push(`[Project instructions \u2014 ${candidate}]
 ${content}`);
+      noteLoaded(path25.join(workDir, candidate), "Project");
       break;
     }
   }
@@ -169301,7 +169938,7 @@ var Spinner = class {
     return this.interval !== null;
   }
 };
-var cliBackgroundAgents = new import_code_core16.BackgroundAgentHub();
+var cliBackgroundAgents = new import_code_core17.BackgroundAgentHub();
 function nextBackgroundChange() {
   return new Promise((resolve11) => {
     const off = cliBackgroundAgents.onChange(() => {
@@ -169319,7 +169956,7 @@ async function initMcp(workDir, override, strict) {
     _mcpManager = null;
     return;
   }
-  _mcpConfig = strict && override ? { mcpServers: {} } : import_code_core16.McpManager.loadConfig(workDir);
+  _mcpConfig = strict && override ? { mcpServers: {} } : import_code_core17.McpManager.loadConfig(workDir);
   if (override)
     Object.assign(_mcpConfig.mcpServers, override.mcpServers);
   if (Object.keys(_mcpConfig.mcpServers).length === 0) {
@@ -169330,12 +169967,12 @@ async function initMcp(workDir, override, strict) {
     await injectMcpTokens(_mcpConfig);
   } catch {
   }
-  const manager = new import_code_core16.McpManager();
+  const manager = new import_code_core17.McpManager();
   await manager.connectAll(_mcpConfig);
   _mcpManager = manager;
 }
 function formatAgentsList(workDir) {
-  const { types: types3, warnings } = (0, import_code_core16.loadAgentTypesWithWarnings)(workDir);
+  const { types: types3, warnings } = (0, import_code_core17.loadAgentTypesWithWarnings)(workDir);
   if (!types3.length)
     return paint.dim("  No agent types found (this should not happen \u2014 builtins always register).");
   const lines = types3.map((t2) => {
@@ -169520,7 +170157,7 @@ function startSessionLog(id, resumed, extra = {}) {
 }
 var failureLedger = new FailureLedger();
 var networkLedger = new NetworkLedger();
-var networkApiHost = hostOf(import_code_core18.API_BASE) ?? import_code_core18.API_BASE;
+var networkApiHost = hostOf(import_code_core19.API_BASE) ?? import_code_core19.API_BASE;
 var notifier = new Notifier({ env: process.env, isTTY: Boolean(process.stdout.isTTY) });
 var userActiveThisTurn = false;
 var failureBannerShown = "";
@@ -169727,7 +170364,7 @@ async function runTurn(messages, modelAlias, workDir, abortSignal, env4, nexrall
   setMode(mode);
   console.log();
   spinner.start("thinking\u2026", { hint: false, verbs: true });
-  const result = await (0, import_code_core16.runAgentLoop)(messages, {
+  const result = await (0, import_code_core17.runAgentLoop)(messages, {
     workDir,
     sessionId: activeSessionIdGetter(),
     model: modelAlias,
@@ -170071,12 +170708,12 @@ async function runTurnHeadless(messages, modelAlias, workDir, _abortSignal, env4
     sessionId: activeSessionIdGetter(),
     cwd: workDir,
     model: modelAlias,
-    tools: _headlessPolicy.onlyTools ? [..._headlessPolicy.onlyTools].sort() : (0, import_code_core16.knownToolNames)(),
+    tools: _headlessPolicy.onlyTools ? [..._headlessPolicy.onlyTools].sort() : (0, import_code_core17.knownToolNames)(),
     permissionMode: _headlessPolicy.permissionMode
   }));
   emit({ type: "start", model: modelAlias, workDir });
   verbose(`[verbose] model=${modelAlias} cwd=${workDir} mode=${mode} session=${activeSessionIdGetter() ?? "-"}`);
-  const result = await (0, import_code_core16.runAgentLoop)(messages, {
+  const result = await (0, import_code_core17.runAgentLoop)(messages, {
     workDir,
     sessionId: activeSessionIdGetter(),
     model: modelAlias,
@@ -170217,16 +170854,43 @@ async function runTurnHeadless(messages, modelAlias, workDir, _abortSignal, env4
         emit({ type: "permission_denied", tool, reason: "tools" });
         return false;
       }
-      const d = (0, import_code_core16.isDestructiveBash)(tool, input);
+      const d = (0, import_code_core17.isDestructiveBash)(tool, input);
+      const policy = (0, import_code_core18.decide)({ tool, input, mode: (0, import_code_core19.parseMode)(mode), bypass: isYoloMode(), destructive: !!d });
       const v = headlessVerdict({
-        rule: (0, import_code_core18.evaluatePermission)((0, import_code_core18.loadSettings)(workDir).permissions, tool, input, workDir),
+        rule: (0, import_code_core19.evaluatePermission)((0, import_code_core19.loadSettings)(workDir).permissions, tool, input, workDir),
         destructive: !!d,
         allowDestructive: process.env.NEXRALL_ALLOW_DESTRUCTIVE === "1",
         strict: _headlessPolicy.strict,
-        policy: (0, import_code_core17.decide)({ tool, input, mode: (0, import_code_core18.parseMode)(mode), bypass: isYoloMode(), destructive: !!d })
+        policy
       });
       if (v.verdict === "allow")
         return true;
+      const hookGate = await runHeadlessPermissionHooks(
+        { tool, input, workDir, sessionId: activeSessionIdGetter() ?? "", reason: v.reason, policyDeny: policy === "deny", destructive: d },
+        emit,
+        emitEvent
+      );
+      if (hookGate.handled === "allow")
+        return true;
+      if (hookGate.handled === "deny")
+        return { granted: false, message: hookGate.message };
+      const toolFlag = _headlessPolicy.permissionPromptTool;
+      if (toolFlag && v.reason !== "rule" && !(policy === "deny")) {
+        const ans = await askPermissionPromptTool(_mcpManager, toolFlag, { tool, input, cwd: workDir, mode, sessionId: activeSessionIdGetter() ?? void 0 }, _abortSignal);
+        if ("error" in ans) {
+          emit({ type: "error", error: `--permission-prompt-tool ${toolFlag}: ${ans.error}` });
+          emitEvent("permission.denied", { tool, reason: "prompt-tool-error" });
+          return { granted: false, message: `Permission denied: ${ans.error}` };
+        }
+        if (ans.behavior === "allow") {
+          emit({ type: "permission_granted", tool, reason: "prompt-tool" });
+          emitEvent("permission.granted", { tool, reason: "prompt-tool" });
+          return ans.updatedInput ? { granted: true, updatedInput: ans.updatedInput } : true;
+        }
+        emit({ type: "permission_denied", tool, reason: "prompt-tool" });
+        emitEvent("permission.denied", { tool, reason: "prompt-tool" });
+        return { granted: false, message: ans.message ? `Permission denied by ${toolFlag}: ${ans.message}` : `Permission denied by ${toolFlag}` };
+      }
       if (v.reason === "destructive" && d) {
         emit({ type: "error", error: `Destructive command blocked in headless mode (${d.category}): ${d.reason}. Set NEXRALL_ALLOW_DESTRUCTIVE=1 to permit.` });
       } else {
@@ -170464,7 +171128,7 @@ async function startChatSession(options) {
   if (options.bare)
     setNoDiscovery(true);
   _cliAgentTypes = (options.agents ?? []).map((a) => ({ ...a, source: "programmatic" }));
-  (0, import_code_core16.enableAgentTranscriptPersistence)();
+  (0, import_code_core17.enableAgentTranscriptPersistence)();
   const headless = options.outputFormat === "json" || options.outputFormat === "stream-json";
   const requestedWorkDir = options.workDir;
   let workDir = requestedWorkDir;
@@ -170473,7 +171137,7 @@ async function startChatSession(options) {
   let peerInbox;
   const peerInboxQueue = [];
   let modelAlias = options.model;
-  void (0, import_code_core16.getModelCatalogue)().catch(() => {
+  void (0, import_code_core17.getModelCatalogue)().catch(() => {
   });
   const canPrompt = !headless && !options.prompt && !options.stdinText && process.stdin.isTTY === true && process.stdout.isTTY === true;
   if (!trustGrantedByEnv()) {
@@ -170501,21 +171165,21 @@ Set ${TRUST_ENV_VAR}=1 to confirm non-interactively, or run \`nex\` interactivel
   }
   const themeConfig = loadAndApplyTheme(workDir);
   const keyConfig = loadAndApplyKeybindings(workDir);
-  liveDiffEnabled = readLiveDiffSetting((0, import_code_core18.loadSettings)(workDir).raw);
-  mouseEnabled = readMouseSetting((0, import_code_core18.loadSettings)(workDir).raw);
-  notifier.setMode(readNotifySetting((0, import_code_core18.loadSettings)(workDir).raw));
+  liveDiffEnabled = readLiveDiffSetting((0, import_code_core19.loadSettings)(workDir).raw);
+  mouseEnabled = readMouseSetting((0, import_code_core19.loadSettings)(workDir).raw);
+  notifier.setMode(readNotifySetting((0, import_code_core19.loadSettings)(workDir).raw));
   setAskNotifier((what) => {
     notifier.notify(needsYouNote(what));
     emitEvent("permission.requested", { what });
-    (0, import_code_core17.fireNotificationHooks)(workDir, `Nexrall needs your permission: ${what}`);
+    (0, import_code_core18.fireNotificationHooks)(workDir, `Nexrall needs your permission: ${what}`);
   });
   setPermissionObserver((tool, granted) => emitEvent(granted ? "permission.granted" : "permission.denied", { tool }));
   let activeThemeName = themeConfig.theme;
   if (options.worktree !== void 0) {
     const requestedName = typeof options.worktree === "string" ? options.worktree : void 0;
-    const existing = requestedName ? (0, import_code_core16.findWorktreeByName)(requestedWorkDir, requestedName) : null;
+    const existing = requestedName ? (0, import_code_core17.findWorktreeByName)(requestedWorkDir, requestedName) : null;
     if (existing) {
-      const entered = (0, import_code_core16.enterWorktree)(existing);
+      const entered = (0, import_code_core17.enterWorktree)(existing);
       if (!entered.ok) {
         process.stderr.write(`Failed to resume worktree "${requestedName}": ${entered.error}
 `);
@@ -170525,7 +171189,7 @@ Set ${TRUST_ENV_VAR}=1 to confirm non-interactively, or run \`nex\` interactivel
       if (!headless)
         console.log(paint.dim(`  Resumed worktree: ${paint.bold(existing.name)} (${existing.worktreePath})`));
     } else {
-      const created = (0, import_code_core16.createWorktree)(requestedWorkDir, requestedName);
+      const created = (0, import_code_core17.createWorktree)(requestedWorkDir, requestedName);
       if (!created.ok || !created.state) {
         process.stderr.write(`Failed to create worktree: ${created.error ?? "unknown error"}
 `);
@@ -170544,7 +171208,7 @@ Set ${TRUST_ENV_VAR}=1 to confirm non-interactively, or run \`nex\` interactivel
     process.on("exit", () => {
       if (!worktreeState)
         return;
-      const hadWork = (0, import_code_core16.worktreeHasWork)(worktreeState);
+      const hadWork = (0, import_code_core17.worktreeHasWork)(worktreeState);
       if (hadWork) {
         process.stderr.write(
           `
@@ -170555,7 +171219,7 @@ Resume it with: nex --worktree ${worktreeState.name}
         );
         return;
       }
-      (0, import_code_core16.removeWorktree)(worktreeState);
+      (0, import_code_core17.removeWorktree)(worktreeState);
     });
   }
   const env4 = collectEnv(workDir);
@@ -170564,7 +171228,7 @@ Resume it with: nex --worktree ${worktreeState.name}
   const nexrallMd = [agentPrefix, briefBase, options.appendSystemPrompt?.trim(), addDirNote(options.addDirs ?? []), options.jsonSchema ? schemaInstruction(options.jsonSchema) : ""].filter(Boolean).join("\n\n") || void 0;
   const agentTools = options.selectedAgent?.tools;
   const toolAllow = agentTools && options.onlyTools ? options.onlyTools.filter((t2) => agentTools.includes(t2)) : options.onlyTools ?? agentTools;
-  _headlessPolicy = { strict: !!options.strictPermissions, budgetUsd: options.budgetUsd, spent: 0, schema: options.jsonSchema, maxTurns: options.maxTurns, onlyTools: toolAllow ? new Set(toolAllow) : void 0 };
+  _headlessPolicy = { strict: !!options.strictPermissions, budgetUsd: options.budgetUsd, spent: 0, schema: options.jsonSchema, maxTurns: options.maxTurns, onlyTools: toolAllow ? new Set(toolAllow) : void 0, permissionPromptTool: options.permissionPromptTool };
   _headlessPolicy.verbose = !!options.verbose;
   _headlessPolicy.includePartial = !!options.includePartialMessages;
   _headlessPolicy.permissionMode = String(options.initialMode ?? "");
@@ -170573,8 +171237,8 @@ Resume it with: nex --worktree ${worktreeState.name}
   const interactive = !headless && !options.prompt && !options.stdinText;
   let peerHeartbeatTimer;
   if (interactive) {
-    const handle2 = (0, import_code_core16.registerPeer)({ clientType: "cli", workDir: requestedWorkDir });
-    const inbox = (0, import_code_core16.startPeerInbox)(handle2.record.id, { onMessage: (m2) => peerInboxQueue.push(m2) });
+    const handle2 = (0, import_code_core17.registerPeer)({ clientType: "cli", workDir: requestedWorkDir });
+    const inbox = (0, import_code_core17.startPeerInbox)(handle2.record.id, { onMessage: (m2) => peerInboxQueue.push(m2) });
     handle2.record.socketPath = inbox.socketPath;
     handle2.heartbeat();
     peerHandle = handle2;
@@ -170646,6 +171310,18 @@ Resume it with: nex --worktree ${worktreeState.name}
   let sessionId = options.newSessionId ?? crypto7.randomBytes(8).toString("hex");
   activeSessionIdGetter = () => sessionId;
   let sessionTitle = options.sessionName ?? "";
+  const fileWatcher = noDiscovery ? null : (0, import_code_core17.startFileChangedWatcher)(workDir, sessionId, {
+    // A hook's {"systemMessage":"…"} is the event's one user-visible field.
+    onSystemMessage: (m2) => console.log(paint.dim(`  ${m2}`))
+  });
+  if (fileWatcher) {
+    const watching = fileWatcher.watchedFiles();
+    if (watching.length && !headless)
+      console.log(paint.dim(`  FileChanged hook: watching ${watching.join(", ")}`));
+    if (options.verbose)
+      process.stderr.write("[verbose] FileChanged hook: " + watching.join(", ") + "\n");
+  }
+  void (0, import_code_core17.fireInstructionsLoadedHooks)(workDir, sessionId, lastLoadedInstructions);
   const modeLocked = options.lockMode === true;
   let agentMode = modeLocked ? "plan" : options.initialMode ?? "auto";
   const refuseIfLocked = (what) => {
@@ -170667,7 +171343,7 @@ Resume it with: nex --worktree ${worktreeState.name}
     for (const n of themeConfig.notes)
       console.log(paint.dim("  theme: " + n));
   }
-  let skills = noDiscovery ? [] : (0, import_code_core16.loadSkills)(workDir);
+  let skills = noDiscovery ? [] : (0, import_code_core17.loadSkills)(workDir);
   if (skills.length && !headless)
     console.log(paint.dim(`  ${skills.length} skill(s) loaded`));
   let contextSet = loadContextSet(workDir);
@@ -170732,7 +171408,7 @@ Resume it with: nex --worktree ${worktreeState.name}
     }
     startSessionLog(sessionId, true, options.forkSession ? { workDir, forkOf: stored.id } : { workDir });
     try {
-      const compacted = await (0, import_code_core16.compactMessagesForResume)(messages, {
+      const compacted = await (0, import_code_core17.compactMessagesForResume)(messages, {
         workDir,
         model: modelAlias,
         clientType: "cli"
@@ -170748,7 +171424,7 @@ Resume it with: nex --worktree ${worktreeState.name}
   }
   if (!(options.resume || options.continueLast))
     startSessionLog(sessionId, false, { workDir });
-  const checkpoints = new import_code_core16.CheckpointManager(workDir, sessionId);
+  const checkpoints = new import_code_core17.CheckpointManager(workDir, sessionId);
   const commitCheckpoint = () => {
     checkpoints.commitTurn();
     emitEvent("checkpoint.created", { turns: checkpoints.list().length });
@@ -170770,7 +171446,7 @@ Resume it with: nex --worktree ${worktreeState.name}
     sessionTitle = raw.length > 60 ? raw.slice(0, 60) + "\u2026" : raw;
   };
   const recoverTurn = (err, current) => {
-    const salvaged = (0, import_code_core16.salvageHistory)(err);
+    const salvaged = (0, import_code_core17.salvageHistory)(err);
     printErrorReport(err, abortSignal.aborted);
     printTurnSummary(abortSignal.aborted ? "interrupted" : "failed");
     if (!salvaged)
@@ -170828,7 +171504,7 @@ ${text}` : "");
             throw e2;
           const from = modelAlias;
           modelAlias = options.fallbackModel;
-          const salvagedMsgs = (0, import_code_core16.salvageHistory)(e2);
+          const salvagedMsgs = (0, import_code_core17.salvageHistory)(e2);
           if (salvagedMsgs)
             messages = salvagedMsgs;
           const note = `Model ${from} failed (${String(e2.message).slice(0, 120)}); retrying on ${modelAlias}`;
@@ -170847,7 +171523,7 @@ ${text}` : "");
           continue;
         }
         const notes = cliBackgroundAgents.takeNotifications();
-        messages.push({ role: "user", content: [{ type: "text", text: (0, import_code_core16.formatBackgroundNotifications)(notes) }] });
+        messages.push({ role: "user", content: [{ type: "text", text: (0, import_code_core17.formatBackgroundNotifications)(notes) }] });
         result = await runOnce();
         messages = result.messages;
       }
@@ -170865,7 +171541,7 @@ ${text}` : "");
             await nextBackgroundChange();
             continue;
           }
-          messages.push({ role: "user", content: [{ type: "text", text: (0, import_code_core16.formatBackgroundNotifications)(cliBackgroundAgents.takeNotifications()) }] });
+          messages.push({ role: "user", content: [{ type: "text", text: (0, import_code_core17.formatBackgroundNotifications)(cliBackgroundAgents.takeNotifications()) }] });
           result = await runOnce();
           messages = result.messages;
         }
@@ -170878,7 +171554,7 @@ ${text}` : "");
       await new Promise((r2) => setImmediate(r2));
       process.exit(process.exitCode ?? 0);
     } catch (err) {
-      const salvaged = (0, import_code_core16.salvageHistory)(err);
+      const salvaged = (0, import_code_core17.salvageHistory)(err);
       if (salvaged) {
         messages = salvaged;
         try {
@@ -170911,12 +171587,12 @@ ${text}` : "");
   console.log(paint.dim("  Type a message, /help for commands, or Ctrl+C to exit."));
   console.log();
   const footerExtras = () => {
-    const win = (0, import_code_core16.contextWindowFor)(modelAlias);
+    const win = (0, import_code_core17.contextWindowFor)(modelAlias);
     return {
       nav: transcriptNav ? navLabel(transcriptNav) : void 0,
       model: resolveModelLabel(modelAlias),
       branch: gitBranch(workDir) ?? void 0,
-      ctxPct: messages.length ? Math.min(100, (0, import_code_core16.estimateTokensRough)(messages) / win * 100) : 0,
+      ctxPct: messages.length ? Math.min(100, (0, import_code_core17.estimateTokensRough)(messages) / win * 100) : 0,
       costUsd: sessionUsage.costReported ? sessionUsage.cost : void 0,
       // Live sub-agents (spec §37). Recomputed per footer render, which is also what
       // retires a background agent's row the moment the hub drops it.
@@ -170986,7 +171662,7 @@ ${text}` : "");
       console.log(paint.green(`  \u2713 Saved to ${saved.scope} memory`) + paint.dim(` \u2014 ${saved.file}`) + (saved.superseded ? paint.dim("  (the older fact moved to Superseded)") : ""));
     }
   };
-  const allSlashEntries = () => [...BUILTIN_SLASH_COMMANDS, ...skillEntries((0, import_code_core16.userInvokableSkills)(skills))];
+  const allSlashEntries = () => [...BUILTIN_SLASH_COMMANDS, ...skillEntries((0, import_code_core17.userInvokableSkills)(skills))];
   let slashRecents = loadRecents();
   const syncSlashMenu = () => {
     if (interactive)
@@ -171028,7 +171704,7 @@ ${text}` : "");
   };
   const modelPickerNote = (id) => {
     const parts = [];
-    const mult = (0, import_code_core16.liveCostMultiplierFor)(id, MODEL_COST_MULTIPLIER[id]);
+    const mult = (0, import_code_core17.liveCostMultiplierFor)(id, MODEL_COST_MULTIPLIER[id]);
     if (mult !== void 0 && mult !== 1)
       parts.push(`${mult}x`);
     if (needsVisionSidecar(id))
@@ -171223,7 +171899,7 @@ ${text}` : "");
       return;
     }
     const row2 = matches[0];
-    const scope = import_code_core16.McpManager.serverScope(workDir, row2.name);
+    const scope = import_code_core17.McpManager.serverScope(workDir, row2.name);
     if (action.kind === "detail") {
       const st = _mcpManager?.getStatus().find((x2) => x2.name === row2.name);
       const tools = (st?.tools ?? []).map((t2) => ({ name: t2.name, description: t2.description }));
@@ -171247,7 +171923,7 @@ ${text}` : "");
     let signedIn = false;
     let attempted = false;
     if (!plan.refuse && plan.persist) {
-      import_code_core16.McpManager.setServerDisabled(workDir, row2.name, plan.persist.disabled, plan.persist.scope);
+      import_code_core17.McpManager.setServerDisabled(workDir, row2.name, plan.persist.disabled, plan.persist.scope);
       noteDisabledInConfig(row2.name, plan.persist.disabled);
     }
     if (!plan.refuse) {
@@ -171432,12 +172108,12 @@ ${text}` : "");
       rl.prompt();
       return;
     }
-    if ((0, import_code_core18.evaluatePermission)(permRules, "bash", { command: cmd }, workDir) === "deny") {
+    if ((0, import_code_core19.evaluatePermission)(permRules, "bash", { command: cmd }, workDir) === "deny") {
       console.log(paint.red("  \u2716 Denied by permission rule: bash"));
       rl.prompt();
       return;
     }
-    if (modeLocked && !(0, import_code_core18.isReadOnlyBash)(cmd)) {
+    if (modeLocked && !(0, import_code_core19.isReadOnlyBash)(cmd)) {
       console.log(paint.yellow("  \u2298 Read-only session (--readonly): only read-only commands can run with !."));
       rl.prompt();
       return;
@@ -171592,7 +172268,7 @@ ${text}` : "");
           emitEvent("session.completed", { id: liveSessionId, reason: "clear" });
           sessionId = crypto7.randomBytes(8).toString("hex");
           sessionTitle = "";
-          (0, import_code_core18.resetSessionSubAgentBudget)();
+          (0, import_code_core19.resetSessionSubAgentBudget)();
           sessionUsage.reset();
           sessionStartedAt = Date.now();
           sessionToolCalls = 0;
@@ -171688,7 +172364,7 @@ ${text}` : "");
           startSessionLog(sessionId, true, { workDir });
           const beforeCompact = messages.length;
           try {
-            await (0, import_code_core16.compactMessagesForResume)(messages, {
+            await (0, import_code_core17.compactMessagesForResume)(messages, {
               workDir,
               model: modelAlias,
               clientType: "cli"
@@ -171742,7 +172418,7 @@ ${text}` : "");
           }
           rl.pause();
           console.log(paint.dim("  Compacting conversation\u2026"));
-          await (0, import_code_core17.fireManualPreCompactHook)(workDir, sessionId, Math.max(0, messages.length - 4));
+          await (0, import_code_core18.fireManualPreCompactHook)(workDir, sessionId, Math.max(0, messages.length - 4));
           const KEEP = 4;
           const toSummarize = messages.slice(0, -KEEP);
           const kept = messages.slice(-KEEP);
@@ -171788,7 +172464,7 @@ ${summaryText}` }] },
             saveSession2(sessionId, sessionTitle || "Untitled", workDir, messages);
             console.log(paint.green(`  Compacted ${toSummarize.length} messages \u2192 ${messages.length} messages.`));
             emitEvent("context.compacted", { where: "manual", before: toSummarize.length + KEEP, after: messages.length });
-            await (0, import_code_core17.fireManualPostCompactHook)(workDir, sessionId, toSummarize.length);
+            await (0, import_code_core18.fireManualPostCompactHook)(workDir, sessionId, toSummarize.length);
             if (pin.attachments.length)
               console.log(paint.dim(`  ${pin.attachments.length} pinned file(s) re-attached.`));
             for (const n of pin.notes)
@@ -171864,13 +172540,13 @@ ${dirList}`;
           const sub = arg.trim().toLowerCase();
           console.log();
           if (sub === "list") {
-            const all = (0, import_code_core16.listWorktrees)(requestedWorkDir);
+            const all = (0, import_code_core17.listWorktrees)(requestedWorkDir);
             if (!all.length) {
               console.log(paint.dim("  No worktrees under this project."));
             } else {
               console.log(paint.bold(`  Worktrees (${all.length})`));
               for (const w of all) {
-                const dirty = (0, import_code_core16.worktreeHasWork)(w) ? paint.yellow("dirty") : paint.dim("clean");
+                const dirty = (0, import_code_core17.worktreeHasWork)(w) ? paint.yellow("dirty") : paint.dim("clean");
                 console.log(`  ${paint.cyan(w.name)}  ${paint.dim(w.worktreePath)}  [${dirty}]`);
               }
               console.log();
@@ -171908,7 +172584,7 @@ ${dirList}`;
             if (!targetName || !text) {
               console.log(paint.dim("  Usage: /peers send <name> <message>"));
             } else {
-              const target = (0, import_code_core16.listPeers)().find((p) => p.name === targetName);
+              const target = (0, import_code_core17.listPeers)().find((p) => p.name === targetName);
               if (!target) {
                 console.log(paint.red(`  No live session named "${targetName}". Use /peers to list who's reachable.`));
               } else if (!target.socketPath) {
@@ -171925,7 +172601,7 @@ ${dirList}`;
               console.log(paint.dim("  Usage: /peers broadcast <message>"));
             } else {
               const { broadcastPeerMessage } = await Promise.resolve().then(() => __toESM(require_dist3(), 1));
-              const targets = (0, import_code_core16.listPeers)(peerHandle.record.id).filter((p) => p.id !== peerHandle.record.id && p.socketPath && p.inbound !== "refuse").map((p) => ({ name: p.name, socketPath: p.socketPath }));
+              const targets = (0, import_code_core17.listPeers)(peerHandle.record.id).filter((p) => p.id !== peerHandle.record.id && p.socketPath && p.inbound !== "refuse").map((p) => ({ name: p.name, socketPath: p.socketPath }));
               if (!targets.length) {
                 console.log(paint.dim("  No other reachable Nexrall Code sessions to broadcast to."));
               } else {
@@ -171937,7 +172613,7 @@ ${dirList}`;
               }
             }
           } else {
-            const peers = (0, import_code_core16.listPeers)(peerHandle.record.id);
+            const peers = (0, import_code_core17.listPeers)(peerHandle.record.id);
             if (peers.length <= 1) {
               console.log(paint.dim("  No other Nexrall Code sessions are currently discoverable on this machine."));
             } else {
@@ -171979,7 +172655,7 @@ ${dirList}`;
             const label = memScope === "global" ? "GLOBAL" : "this PROJECT's";
             const answer = await new Promise((resolve11) => rl.question(paint.yellow(`  Clear ${label} memory? This cannot be undone. [y/n] `), (a) => resolve11(a.trim())));
             if (answer === "y" || answer === "yes") {
-              (0, import_code_core16.clearMemory)(memScope, workDir);
+              (0, import_code_core17.clearMemory)(memScope, workDir);
               console.log(paint.green(`  ${memScope === "global" ? "Global" : "Project"} memory cleared.`));
             } else {
               console.log(paint.dim("  Cancelled."));
@@ -171990,20 +172666,20 @@ ${dirList}`;
           }
           console.log();
           if (wantsGlobalOnly) {
-            const stats = (0, import_code_core16.memoryStats)("global");
-            const content = (0, import_code_core16.readMemory)("global", void 0, { includeArchived: wantsArchived });
+            const stats = (0, import_code_core17.memoryStats)("global");
+            const content = (0, import_code_core17.readMemory)("global", void 0, { includeArchived: wantsArchived });
             const archivedNote = stats.archived > 0 ? `, ${stats.archived} archived` : "";
             console.log(paint.bold("  Global memory ") + paint.dim(`(${stats.entries} entries${archivedNote}, ${(stats.bytes / 1024).toFixed(1)}KB) \u2014 ${stats.file}`));
             console.log();
             console.log(content || paint.dim("  No global memories saved yet."));
           } else {
-            const projStats = (0, import_code_core16.memoryStats)("project", workDir);
-            const globalStats = (0, import_code_core16.memoryStats)("global");
+            const projStats = (0, import_code_core17.memoryStats)("project", workDir);
+            const globalStats = (0, import_code_core17.memoryStats)("global");
             const projArchived = projStats.archived > 0 ? `+${projStats.archived} archived ` : "";
             const globalArchived = globalStats.archived > 0 ? `+${globalStats.archived} archived ` : "";
             console.log(paint.bold("  Memory") + paint.dim(`  \u2014 project: ${projStats.entries} ${projArchived}entries (${(projStats.bytes / 1024).toFixed(1)}KB)  \xB7  global: ${globalStats.entries} ${globalArchived}entries (${(globalStats.bytes / 1024).toFixed(1)}KB)`));
             console.log();
-            const merged = (0, import_code_core16.readAllMemory)(workDir, { includeArchived: wantsArchived });
+            const merged = (0, import_code_core17.readAllMemory)(workDir, { includeArchived: wantsArchived });
             console.log(merged || paint.dim("  No memories saved yet."));
           }
           console.log();
@@ -172038,12 +172714,12 @@ ${dirList}`;
             console.log(paint.dim(`  Current: ${paint.cyan(agentMode)}`));
             for (const m2 of ["ask", "edit", "auto", "plan"]) {
               const marker = m2 === agentMode ? paint.cyan("\u276F") : " ";
-              console.log(`  ${marker} ${paint.bold(m2.padEnd(5))} ${paint.dim((0, import_code_core18.describeMode)(m2).replace(`${m2} \u2014 `, ""))}`);
+              console.log(`  ${marker} ${paint.bold(m2.padEnd(5))} ${paint.dim((0, import_code_core19.describeMode)(m2).replace(`${m2} \u2014 `, ""))}`);
             }
           } else if (["ask", "edit", "plan", "auto"].includes(modeArg)) {
             agentMode = modeArg;
             updateFooter();
-            console.log(paint.green(`  Mode \u2192 ${paint.bold(modeArg)}`) + paint.dim(`  ${(0, import_code_core18.describeMode)(modeArg).replace(`${modeArg} \u2014 `, "")}`));
+            console.log(paint.green(`  Mode \u2192 ${paint.bold(modeArg)}`) + paint.dim(`  ${(0, import_code_core19.describeMode)(modeArg).replace(`${modeArg} \u2014 `, "")}`));
           } else {
             console.log(paint.red(`  Unknown: ${modeArg}`));
           }
@@ -172084,22 +172760,22 @@ ${dirList}`;
               if (target === void 0) {
                 console.log(paint.red("  Usage: /team use <team id|personal>   (/team lists the ids)"));
               } else {
-                await (0, import_code_core16.setBillingTarget)(target);
+                await (0, import_code_core17.setBillingTarget)(target);
                 console.log(paint.green(`  \u2713 Usage will now be billed to ${target === null ? "your personal wallet" : `team ${target}`}.`));
                 if (target !== null)
                   console.log(paint.dim("    This applies to every product and client on this account, not just the CLI."));
               }
             } else {
               try {
-                const orgs = await (0, import_code_core16.getOrgs)();
-                const pin = (0, import_code_core16.billingOverrideFields)();
+                const orgs = await (0, import_code_core17.getOrgs)();
+                const pin = (0, import_code_core17.billingOverrideFields)();
                 for (const l2 of billingLines(orgs, "teamId" in pin ? pin.teamId : void 0)) {
                   console.log(l2.startsWith("!") ? paint.yellow("  " + l2) : "  " + l2);
                 }
               } catch (orgErr) {
                 if (cmd === "/team")
                   throw orgErr;
-                const bal = await (0, import_code_core16.getBalance)();
+                const bal = await (0, import_code_core17.getBalance)();
                 console.log(paint.dim("  Balance: ") + paint.cyan(`$${bal.toFixed(4)}`));
               }
             }
@@ -172493,7 +173169,7 @@ ${dirList}`;
           }
           agentMode = "plan";
           updateFooter();
-          console.log(paint.green(`  Mode \u2192 ${paint.bold("plan")}`) + paint.dim(`  ${(0, import_code_core18.describeMode)("plan").replace("plan \u2014 ", "")}  (/mode auto to leave)`));
+          console.log(paint.green(`  Mode \u2192 ${paint.bold("plan")}`) + paint.dim(`  ${(0, import_code_core19.describeMode)("plan").replace("plan \u2014 ", "")}  (/mode auto to leave)`));
           rl.prompt();
           return;
         }
@@ -172501,7 +173177,7 @@ ${dirList}`;
           const parts2 = arg.trim().split(/\s+/).filter(Boolean);
           const scope = parts2.includes("--project") ? "project" : "user";
           const want = (parts2.find((x2) => x2 !== "--project") ?? "").toLowerCase();
-          const customColorsNow = () => readThemeConfig((0, import_code_core18.loadSettings)(workDir).raw).custom;
+          const customColorsNow = () => readThemeConfig((0, import_code_core19.loadSettings)(workDir).raw).custom;
           const switchTheme = (name, persist) => {
             const out = applyThemeConfig({ theme: name, custom: name === "custom" ? customColorsNow() : {}, errors: [] });
             activeThemeName = name;
@@ -172519,7 +173195,7 @@ ${dirList}`;
             const w = clearThemeKeys(workDir, scope);
             if (!w.ok)
               console.log(paint.yellow(`  Could not write ${w.path}: ${w.error}`));
-            const after = readThemeConfig((0, import_code_core18.loadSettings)(workDir).raw);
+            const after = readThemeConfig((0, import_code_core19.loadSettings)(workDir).raw);
             const out = applyThemeConfig(after);
             activeThemeName = after.theme;
             console.log("  " + paint.green(`Theme reset: ${out.resolved}`) + paint.dim(`  \xB7 removed theme/themeColors from ${settingsPath(workDir, scope)}`));
@@ -172610,7 +173286,7 @@ ${dirList}`;
           }
           const types3 = (() => {
             try {
-              return (0, import_code_core16.loadAgentTypesWithWarnings)(workDir).types.map((t2) => ({
+              return (0, import_code_core17.loadAgentTypesWithWarnings)(workDir).types.map((t2) => ({
                 name: t2.name,
                 description: t2.description,
                 ...t2.tools ? { tools: t2.tools } : {},
@@ -172623,7 +173299,7 @@ ${dirList}`;
           for (const l2 of formatPermissions({
             rules: permRules,
             workDir,
-            mode: (0, import_code_core18.parseMode)(agentMode),
+            mode: (0, import_code_core19.parseMode)(agentMode),
             yolo: isYoloMode(),
             agents: types3,
             // The guard the dashboard describes is the one the handler actually runs, so the
@@ -172828,7 +173504,7 @@ ${caption}` : `[Attached: ${rel}]`;
           if (needsSidecar) {
             console.log(paint.dim(`  ${resolveModelLabel(modelAlias)} can't read ${isPdf ? "PDFs" : "images"} directly \u2014 describing ${rel} with Claude Sonnet 5.5 first\u2026`));
             try {
-              const { text } = await (0, import_code_core16.describeAttachment)(isPdf ? "pdf" : "image", data, mimeType, rel);
+              const { text } = await (0, import_code_core17.describeAttachment)(isPdf ? "pdf" : "image", data, mimeType, rel);
               content.push({ type: "text", text: `<attachment_description>
 ${text}
 </attachment_description>` });
@@ -172872,7 +173548,7 @@ ${text}
           process.exit(0);
         }
         case "/plugins": {
-          const plugins = (0, import_code_core16.loadPlugins)(workDir);
+          const plugins = (0, import_code_core17.loadPlugins)(workDir);
           if (!plugins.length) {
             console.log(paint.dim("  No plugins installed. Install one:  nex plugin install owner/repo"));
           } else {
@@ -172885,7 +173561,7 @@ ${text}
             }
             console.log();
           }
-          skills = (0, import_code_core16.loadSkills)(workDir);
+          skills = (0, import_code_core17.loadSkills)(workDir);
           syncSlashMenu();
           rl.prompt();
           return;
@@ -173076,7 +173752,7 @@ ${text}
           return;
         }
         case "/handoff": {
-          const types3 = (0, import_code_core16.loadAgentTypesWithWarnings)(workDir).types.map((t2) => t2.name);
+          const types3 = (0, import_code_core17.loadAgentTypesWithWarnings)(workDir).types.map((t2) => t2.name);
           const parsed = parseHandoffArgs(arg, types3);
           if ("error" in parsed) {
             console.log(paint.red("  " + parsed.error));
@@ -173109,8 +173785,8 @@ ${text}
             return;
           }
           const measure = measureContext(messages, parsed.all ? TOP_ALL : TOP_DEFAULT);
-          const window2 = (0, import_code_core16.contextWindowFor)(modelAlias);
-          const thresholds = (0, import_code_core16.compactionThresholds)(window2);
+          const window2 = (0, import_code_core17.contextWindowFor)(modelAlias);
+          const thresholds = (0, import_code_core17.compactionThresholds)(window2);
           for (const line of formatContextPanel({
             measure,
             window: window2,
@@ -173127,9 +173803,9 @@ ${text}
         }
         case "/skills":
         case "/commands": {
-          skills = (0, import_code_core16.loadSkills)(workDir);
+          skills = (0, import_code_core17.loadSkills)(workDir);
           syncSlashMenu();
-          const invocable = (0, import_code_core16.userInvokableSkills)(skills);
+          const invocable = (0, import_code_core17.userInvokableSkills)(skills);
           if (!invocable.length) {
             console.log(paint.dim("  No skills. Add .nexrall/skills/<name>/SKILL.md (or .nexrall/commands/<name>.md) to create one."));
           } else {
@@ -173305,15 +173981,15 @@ ${text}
           return;
         }
         default: {
-          const custom = (0, import_code_core16.findSkill)(skills, cmd);
+          const custom = (0, import_code_core17.findSkill)(skills, cmd);
           if (!custom) {
             console.log(paint.red(`  Unknown command: ${cmd}`));
             console.log(paint.dim("  Type /help for built-ins or /skills for custom ones."));
             rl.prompt();
             return;
           }
-          const expanded = (0, import_code_core16.expandSkill)(custom, arg, workDir);
-          const turnModel = (0, import_code_core16.resolveSubAgentModel)(custom.model, modelAlias) ?? modelAlias;
+          const expanded = (0, import_code_core17.expandSkill)(custom, arg, workDir);
+          const turnModel = (0, import_code_core17.resolveSubAgentModel)(custom.model, modelAlias) ?? modelAlias;
           const turnMode = modeLocked ? "plan" : custom.mode ?? agentMode;
           console.log(paint.dim(`  Running /${custom.name}\u2026`));
           checkpoints.beginTurn(`/${custom.name} ${arg}`.trim(), messages.length);
@@ -173348,7 +174024,7 @@ ${text}
     }
     checkpoints.beginTurn(userInput, messages.length);
     const mentions = expandMentions(userInput, workDir, {
-      isDenied: (abs) => (0, import_code_core18.evaluatePermission)(permRules, "read_file", { path: abs }, workDir) === "deny"
+      isDenied: (abs) => (0, import_code_core19.evaluatePermission)(permRules, "read_file", { path: abs }, workDir) === "deny"
     });
     for (const a of mentions.attachments) {
       console.log(paint.dim(`  + ${a.kind === "dir" ? a.rel + "/" : a.rel} (${a.lines} ${a.kind === "dir" ? "entries" : "lines"}${a.truncated ? ", truncated" : ""})`));
@@ -173389,7 +174065,7 @@ ${text}
       const notes = cliBackgroundAgents.takeNotifications();
       console.log(paint.dim(`  \u2699 background agent${notes.length > 1 ? "s" : ""} ${notes.map((n) => `"${n.description}"`).join(", ")} finished \u2014 continuing`));
       notifier.notify(bgAgentNote(notes.map((n) => n.description)));
-      rl.emit("line", (0, import_code_core16.formatBackgroundNotifications)(notes));
+      rl.emit("line", (0, import_code_core17.formatBackgroundNotifications)(notes));
     }, 400);
   }
   cliBackgroundAgents.onChange(() => {
@@ -173400,6 +174076,7 @@ ${text}
     deliverBackgroundWhenIdle();
   });
   rl.on("close", () => {
+    fileWatcher?.stop();
     updateTitle();
     if (messages.length)
       saveSession2(sessionId, sessionTitle || "Untitled", workDir, messages);
@@ -173410,7 +174087,7 @@ ${text}
 
 // src/commands/plugin.ts
 var import_prompts = __toESM(require_prompts3(), 1);
-var import_code_core19 = __toESM(require_dist3(), 1);
+var import_code_core20 = __toESM(require_dist3(), 1);
 function describeInspection(i2, name, ctx) {
   console.log();
   console.log(paint.bold(`  Plugin: ${name}`) + (i2.meta.version ? paint.dim(`  v${i2.meta.version}`) : ""));
@@ -173486,14 +174163,14 @@ async function pluginInstallCommand(spec, opts) {
     let registryName;
     const isShortName = /^[\w.-]+$/.test(spec.trim()) && !spec.includes("/");
     if (isShortName) {
-      const alias = (0, import_code_core19.resolveSourceAlias)(spec.trim(), process.cwd(), { includeProject: true });
+      const alias = (0, import_code_core20.resolveSourceAlias)(spec.trim(), process.cwd(), { includeProject: true });
       if (alias) {
         source2 = alias.spec;
         console.log(paint.dim(`  Source: ${alias.name} (${alias.tier}) \u2190 ${alias.spec}`));
       }
     }
     if (isShortName && source2 === spec) {
-      const entry = await (0, import_code_core19.getRegistryPlugin)(spec.trim()).catch(() => null);
+      const entry = await (0, import_code_core20.getRegistryPlugin)(spec.trim()).catch(() => null);
       if (entry) {
         source2 = entry.source;
         registryName = entry.name;
@@ -173508,7 +174185,7 @@ async function pluginInstallCommand(spec, opts) {
         return;
       }
     }
-    const res = await (0, import_code_core19.installPlugin)(source2, {
+    const res = await (0, import_code_core20.installPlugin)(source2, {
       scope,
       workDir: process.cwd(),
       name: opts.name ?? registryName,
@@ -173516,7 +174193,7 @@ async function pluginInstallCommand(spec, opts) {
       confirm: (i2, name, ctx) => confirmInstall(i2, name, opts.yes === true, ctx)
     });
     if (registryName)
-      (0, import_code_core19.reportInstall)(registryName);
+      (0, import_code_core20.reportInstall)(registryName);
     console.log();
     console.log(paint.green(`  \u2713 Installed "${res.name}" (${res.scope}) \u2192 ${res.dir}`) + (res.sha ? paint.dim(`  @ ${res.sha.slice(0, 7)}`) : ""));
     if (res.inspection.commands.length) {
@@ -173530,7 +174207,7 @@ async function pluginInstallCommand(spec, opts) {
 }
 function pluginRemoveCommand(name, opts) {
   try {
-    const dir = (0, import_code_core19.removePlugin)(name, {
+    const dir = (0, import_code_core20.removePlugin)(name, {
       scope: opts.project ? "project" : void 0,
       // no flag → search both scopes
       workDir: process.cwd()
@@ -173543,14 +174220,14 @@ function pluginRemoveCommand(name, opts) {
 }
 async function pluginUpdateCommand(name, opts) {
   const workDir = process.cwd();
-  const targets = name ? [name] : (0, import_code_core19.loadPlugins)(workDir).filter((p) => (0, import_code_core19.readReceipt)(p.dir)?.kind === "github").map((p) => p.name);
+  const targets = name ? [name] : (0, import_code_core20.loadPlugins)(workDir).filter((p) => (0, import_code_core20.readReceipt)(p.dir)?.kind === "github").map((p) => p.name);
   if (!targets.length) {
     console.log(paint.dim("  No updatable plugins (only GitHub-installed plugins with receipts can update)."));
     return;
   }
   for (const t2 of targets) {
     try {
-      const res = await (0, import_code_core19.updatePlugin)(t2, {
+      const res = await (0, import_code_core20.updatePlugin)(t2, {
         workDir,
         confirm: (i2, n, ctx) => confirmInstall(i2, n, opts.yes === true, ctx)
       });
@@ -173567,7 +174244,7 @@ function badgeFor(p) {
 }
 async function pluginSearchCommand(query) {
   try {
-    const results = await (0, import_code_core19.searchRegistry)(query);
+    const results = await (0, import_code_core20.searchRegistry)(query);
     if (!results.length) {
       console.log(paint.dim(query ? `  No plugins matching "${query}".` : "  Registry is empty."));
       return;
@@ -173590,7 +174267,7 @@ async function pluginSearchCommand(query) {
 }
 async function pluginInfoCommand(name) {
   try {
-    const p = await (0, import_code_core19.getRegistryPlugin)(name);
+    const p = await (0, import_code_core20.getRegistryPlugin)(name);
     if (!p) {
       console.error(paint.red(`  \u2717 "${name}" not found in the registry.`));
       process.exitCode = 1;
@@ -173626,7 +174303,7 @@ async function pluginInfoCommand(name) {
   }
 }
 function pluginListCommand() {
-  const plugins = (0, import_code_core19.loadPlugins)(process.cwd());
+  const plugins = (0, import_code_core20.loadPlugins)(process.cwd());
   if (!plugins.length) {
     console.log(paint.dim("  No plugins installed."));
     console.log(paint.dim("  Install one:  nex plugin install owner/repo"));
@@ -173635,10 +174312,10 @@ function pluginListCommand() {
   console.log();
   console.log(paint.bold("  Installed plugins:"));
   for (const p of plugins) {
-    const receipt = (0, import_code_core19.readReceipt)(p.dir);
+    const receipt = (0, import_code_core20.readReceipt)(p.dir);
     const src = receipt ? paint.dim(`  \u2190 ${receipt.source}`) : paint.dim("  (manual)");
     const at = receipt?.sha ? paint.dim(` @ ${receipt.sha.slice(0, 7)}`) : "";
-    const insp = (0, import_code_core19.inspectPluginDir)(p.dir);
+    const insp = (0, import_code_core20.inspectPluginDir)(p.dir);
     const runs2 = insp.hasHooks || insp.hasMcp ? paint.yellow(`  \u26A0 ${[insp.hasHooks && "hooks", insp.hasMcp && "mcp"].filter(Boolean).join("+")}`) : "";
     console.log(
       "  " + paint.cyan(p.name.padEnd(24)) + paint.dim(`${(p.version ?? "").padEnd(10)}${p.scope.padEnd(9)}`) + src + at + runs2
@@ -173648,8 +174325,8 @@ function pluginListCommand() {
 }
 function pluginSourceListCommand() {
   const workDir = process.cwd();
-  const sources = (0, import_code_core19.loadDeclaredSources)(workDir, { includeProject: true });
-  const patterns = (0, import_code_core19.allowedSourcePatterns)();
+  const sources = (0, import_code_core20.loadDeclaredSources)(workDir, { includeProject: true });
+  const patterns = (0, import_code_core20.allowedSourcePatterns)();
   if (patterns) {
     console.log();
     console.log(paint.bold("  Organisation policy: ") + paint.dim(`installs restricted to ${patterns.join(", ")}`));
@@ -173664,7 +174341,7 @@ function pluginSourceListCommand() {
   console.log(paint.bold("  Declared plugin sources:"));
   for (const s2 of sources) {
     const tier2 = s2.tier === "project" ? paint.yellow(s2.tier.padEnd(9)) : paint.dim(s2.tier.padEnd(9));
-    const blocked = !(0, import_code_core19.isSourceAllowed)(s2.spec, patterns) ? paint.red("  \u2717 blocked by policy") : "";
+    const blocked = !(0, import_code_core20.isSourceAllowed)(s2.spec, patterns) ? paint.red("  \u2717 blocked by policy") : "";
     console.log("  " + paint.cyan(s2.name.padEnd(20)) + tier2 + paint.white(s2.spec) + blocked);
   }
   console.log();
@@ -173674,17 +174351,17 @@ function pluginSourceListCommand() {
 }
 function pluginSourceAddCommand(name, spec, opts) {
   try {
-    (0, import_code_core19.parsePluginSource)(spec);
-    const patterns = (0, import_code_core19.allowedSourcePatterns)();
-    if (patterns && !(0, import_code_core19.isSourceAllowed)(spec, patterns)) {
+    (0, import_code_core20.parsePluginSource)(spec);
+    const patterns = (0, import_code_core20.allowedSourcePatterns)();
+    if (patterns && !(0, import_code_core20.isSourceAllowed)(spec, patterns)) {
       console.error(paint.red(`  \u2717 "${spec}" is not permitted by your organisation's policy.`));
       console.error(paint.dim(`    Allowed: ${patterns.join(", ")}`));
       process.exitCode = 1;
       return;
     }
     const scope = opts.project ? "project" : "user";
-    const file = (0, import_code_core19.sourcesFileFor)(scope, process.cwd());
-    (0, import_code_core19.writeDeclaredSource)(file, name, spec);
+    const file = (0, import_code_core20.sourcesFileFor)(scope, process.cwd());
+    (0, import_code_core20.writeDeclaredSource)(file, name, spec);
     console.log();
     console.log(paint.green(`  \u2713 Declared "${name}" \u2192 ${spec}`) + paint.dim(`  (${scope})`));
     console.log(paint.dim(`    ${file}`));
@@ -173698,13 +174375,13 @@ function pluginSourceAddCommand(name, spec, opts) {
 function pluginSourceRemoveCommand(name, opts) {
   const workDir = process.cwd();
   const scope = opts.project ? "project" : "user";
-  const file = (0, import_code_core19.sourcesFileFor)(scope, workDir);
-  if ((0, import_code_core19.removeDeclaredSource)(file, name)) {
+  const file = (0, import_code_core20.sourcesFileFor)(scope, workDir);
+  if ((0, import_code_core20.removeDeclaredSource)(file, name)) {
     console.log(paint.green(`  \u2713 Removed source "${name}" (${scope})`));
     console.log(paint.dim("    Plugins already installed from it are untouched \u2014 remove them with  nex plugin remove <name>"));
     return;
   }
-  const found = (0, import_code_core19.resolveSourceAlias)(name, workDir, { includeProject: true });
+  const found = (0, import_code_core20.resolveSourceAlias)(name, workDir, { includeProject: true });
   if (found) {
     console.error(paint.red(`  \u2717 "${name}" is declared in the ${found.tier} tier, not ${scope}.`));
     console.error(paint.dim(`    ${found.file}`));
@@ -173719,7 +174396,7 @@ function pluginSourceRemoveCommand(name, opts) {
 }
 
 // src/index.ts
-var import_code_core21 = __toESM(require_dist3(), 1);
+var import_code_core22 = __toESM(require_dist3(), 1);
 
 // src/commands/bgJobs.ts
 import * as fs26 from "node:fs";
@@ -173948,7 +174625,7 @@ var program2 = new Command();
 program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version(NEX_VERSION).enablePositionalOptions();
 var auth = program2.command("auth").description("Login to your Nexrall account").action(authCommand);
 auth.command("status").description("Show whether you are logged in (exit 0 = yes, 1 = no). --json for scripts; the token is never printed").option("--json", "Machine-readable output").action((opts) => {
-  const r2 = authStatusReport((0, import_code_core21.loadAuth)(), process.env);
+  const r2 = authStatusReport((0, import_code_core22.loadAuth)(), process.env);
   if (opts.json)
     console.log(JSON.stringify(r2));
   else if (!r2.loggedIn)
@@ -174194,8 +174871,8 @@ program2.command("sessions").description("List, export, import, or delete saved
   console.log(paint.dim("  nex sessions --events <id> [--json]       to follow its event stream"));
   console.log();
 });
-program2.option("-p, --pro", "Use Claude Opus 5.5 (most capable)").option("-t, --turbo", "Use Claude Sonnet 5.5 (fast)").option("-u, --ultra", "Use Claude Fable 5.1 (most powerful)").option("-y, --yolo", "Auto-approve all tool calls (no permission prompts)").option("-d, --dir <path>", "Set working directory (default: current directory)").option("-m, --model <name>", "Explicit model, e.g. claude-opus-5-5 | gpt-5.4 | gpt-4.1").option("-r, --resume [id]", "Resume last session, or a specific session id").option("-c, --continue", "Continue the latest conversation in this folder").option("--plan", "Start in plan mode (read-only; /mode or Shift+Tab can leave it)").option("--readonly", "Read-only for the whole session: plan mode that cannot be switched off").option("--auto", "Start in auto mode (the default \u2014 edits and commands run without asking)").option("--mode <mode>", "Starting permission mode: ask | edit | auto | plan").option("--fullscreen", "Draw the whole session on the terminal's alternate screen: the transcript re-wraps on resize and PgUp/PgDn page through it (no terminal scrollback while it is on; /fullscreen toggles it)").option("--bg", "Run the prompt in the background (headless); returns a job id. See: nex jobs | logs | attach | kill").option("--debug", "Write request timing, retries and errors to a debug log file").option("--no-color", "Disable colored output (also honours NO_COLOR)").option("-w, --worktree [name]", "Isolate this session in its own worktree \u2014 a separate directory (and, in a git repo, its own branch) so it can never overwrite files another session (or you) are touching in the main checkout. Omit a name for an auto-generated one; pass an existing name to resume that same worktree.").option("-e, --effort <level>", "Thinking effort \u2014 real levels depend on the model (e.g. DeepSeek: low|high|max, Qwen: low|high); run `nex --model <id>` then `/effort` with no argument to see a model's scale").option("--no-banner", "Skip the ASCII banner (useful in scripts/pipes)").option("--output-format <fmt>", "One-shot output format: text | json | stream-json (implies auto-approve)").option("--audit [path]", "Log every tool call (and refusal) to a JSONL trail (default: .nexrall/audit/<session>.jsonl)").option("--permission-mode <mode>", "Permission mode: ask | edit | auto | plan (also Claude Code names: default | acceptEdits | bypassPermissions). With --output-format, anything that would prompt is DENIED instead of auto-approved").option("--allowedTools, --allowed-tools <tools...>", 'Tools/rules to allow without asking, e.g. "Bash(git *)" Edit (comma or space separated; put the prompt BEFORE this flag)').option("--disallowedTools, --disallowed-tools <tools...>", 'Tools/rules to deny, e.g. "Bash(rm *)" (deny always wins)').option("--append-system-prompt <text>", "Extra instructions appended to the project brief for this run").option("--max-budget-usd <amount>", "Stop a one-shot run once it has spent this many dollars (needs --output-format)").option("--mcp-config <configs...>", 'Load MCP servers from JSON files or inline JSON ({"mcpServers":{\u2026}}) for this run').option("--strict-mcp-config", "With --mcp-config: use ONLY those servers, ignoring ~/.nexrall/mcp.json and the project one").option("--add-dir <dirs...>", "Extra directories the agent may read and edit besides the project folder").option("--input-format <format>", "text (default) | stream-json \u2014 read the prompt as Claude-Code-style NDJSON user messages on stdin").option("--json-schema <schema>", 'JSON Schema (inline or file) the final answer must satisfy; needs --output-format. Result gains "structured_output"; exit 3 if it does not validate').option("--no-session-persistence", "Do not save this run to disk (needs --output-format; it cannot be resumed)").option("--max-turns <n>", "Stop a headless run after N agent rounds (needs --output-format; exit 4 when it hits the limit)").option("--append-system-prompt-file <path>", "Like --append-system-prompt, read from a file").option("--system-prompt <text>", "REPLACE the project brief (nexrall.md + memory + global instructions) with this text for this run").option("--system-prompt-file <path>", "Like --system-prompt, read from a file").option("--verbose", "Print progress detail (tool calls, timings, usage) to stderr while a one-shot run works").option("--include-partial-messages", "Stream model deltas as they arrive (needs --output-format stream-json)").option("--replay-user-messages", "Echo each stdin message back on stdout as it is consumed (needs --input-format stream-json --output-format stream-json)").option("--agents <json-or-file>", 'Define extra sub-agents for this run: a JSON object { "name": { "description", "prompt", "tools", "model" } } or @file.json').option("--agent <name>", "Run this session AS that agent (its prompt, tools and model), from .nexrall/agents, a plugin, --agents or a builtin").option("--bare", "Start without discovery: no nexrall.md/memory, skills, plugins, hooks or MCP config files").option("--safe-mode", "Same as --bare (Claude Code's troubleshooting name)").option("--tools <list>", 'Exactly these built-in tools ("Bash,Read,Edit", "default", or "" for none); the rest are removed, not just unapproved').option("--session-id <id>", "Use this id for a NEW conversation (letters, digits, - _), so a script can find it again").option("-n, --name <name>", "Name the conversation; `nex -r <name>` resumes it by that name").option("--fork-session", "With --resume/--continue: branch into a new session instead of continuing the original").option("--fallback-model <name>", "If the main model is overloaded or unreachable, retry the turn once on this model (needs --output-format)").option("--settings <file|json>", "Settings (permissions, hooks\u2026) for this run only: a JSON file or an inline JSON object; merged over the user/project settings").option("--debug-file <path>", "Write the --debug diagnostics log to this file (implies --debug)").argument("[prompt...]", "One-shot prompt \u2014 if omitted, starts interactive mode").action(async (promptParts, options) => {
-  if (!(0, import_code_core20.isAuthenticated)()) {
+program2.option("-p, --pro", "Use Claude Opus 5.5 (most capable)").option("-t, --turbo", "Use Claude Sonnet 5.5 (fast)").option("-u, --ultra", "Use Claude Fable 5.1 (most powerful)").option("-y, --yolo", "Auto-approve all tool calls (no permission prompts)").option("-d, --dir <path>", "Set working directory (default: current directory)").option("-m, --model <name>", "Explicit model, e.g. claude-opus-5-5 | gpt-5.4 | gpt-4.1").option("-r, --resume [id]", "Resume last session, or a specific session id").option("-c, --continue", "Continue the latest conversation in this folder").option("--plan", "Start in plan mode (read-only; /mode or Shift+Tab can leave it)").option("--readonly", "Read-only for the whole session: plan mode that cannot be switched off").option("--auto", "Start in auto mode (the default \u2014 edits and commands run without asking)").option("--mode <mode>", "Starting permission mode: ask | edit | auto | plan").option("--fullscreen", "Draw the whole session on the terminal's alternate screen: the transcript re-wraps on resize and PgUp/PgDn page through it (no terminal scrollback while it is on; /fullscreen toggles it)").option("--bg", "Run the prompt in the background (headless); returns a job id. See: nex jobs | logs | attach | kill").option("--debug", "Write request timing, retries and errors to a debug log file").option("--no-color", "Disable colored output (also honours NO_COLOR)").option("-w, --worktree [name]", "Isolate this session in its own worktree \u2014 a separate directory (and, in a git repo, its own branch) so it can never overwrite files another session (or you) are touching in the main checkout. Omit a name for an auto-generated one; pass an existing name to resume that same worktree.").option("-e, --effort <level>", "Thinking effort \u2014 real levels depend on the model (e.g. DeepSeek: low|high|max, Qwen: low|high); run `nex --model <id>` then `/effort` with no argument to see a model's scale").option("--no-banner", "Skip the ASCII banner (useful in scripts/pipes)").option("--output-format <fmt>", "One-shot output format: text | json | stream-json (implies auto-approve)").option("--audit [path]", "Log every tool call (and refusal) to a JSONL trail (default: .nexrall/audit/<session>.jsonl)").option("--permission-mode <mode>", "Permission mode: ask | edit | auto | plan (also Claude Code names: default | acceptEdits | bypassPermissions). With --output-format, anything that would prompt is DENIED instead of auto-approved").option("--allowedTools, --allowed-tools <tools...>", 'Tools/rules to allow without asking, e.g. "Bash(git *)" Edit (comma or space separated; put the prompt BEFORE this flag)').option("--disallowedTools, --disallowed-tools <tools...>", 'Tools/rules to deny, e.g. "Bash(rm *)" (deny always wins)').option("--append-system-prompt <text>", "Extra instructions appended to the project brief for this run").option("--max-budget-usd <amount>", "Stop a one-shot run once it has spent this many dollars (needs --output-format)").option("--mcp-config <configs...>", 'Load MCP servers from JSON files or inline JSON ({"mcpServers":{\u2026}}) for this run').option("--strict-mcp-config", "With --mcp-config: use ONLY those servers, ignoring ~/.nexrall/mcp.json and the project one").option("--add-dir <dirs...>", "Extra directories the agent may read and edit besides the project folder").option("--input-format <format>", "text (default) | stream-json \u2014 read the prompt as Claude-Code-style NDJSON user messages on stdin").option("--json-schema <schema>", 'JSON Schema (inline or file) the final answer must satisfy; needs --output-format. Result gains "structured_output"; exit 3 if it does not validate').option("--no-session-persistence", "Do not save this run to disk (needs --output-format; it cannot be resumed)").option("--max-turns <n>", "Stop a headless run after N agent rounds (needs --output-format; exit 4 when it hits the limit)").option("--permission-prompt-tool <t>", "MCP tool (mcp__server__tool) that answers permission prompts in non-interactive runs \u2014 instead of nex denying them").option("--append-system-prompt-file <path>", "Like --append-system-prompt, read from a file").option("--system-prompt <text>", "REPLACE the project brief (nexrall.md + memory + global instructions) with this text for this run").option("--system-prompt-file <path>", "Like --system-prompt, read from a file").option("--verbose", "Print progress detail (tool calls, timings, usage) to stderr while a one-shot run works").option("--include-partial-messages", "Stream model deltas as they arrive (needs --output-format stream-json)").option("--replay-user-messages", "Echo each stdin message back on stdout as it is consumed (needs --input-format stream-json --output-format stream-json)").option("--agents <json-or-file>", 'Define extra sub-agents for this run: a JSON object { "name": { "description", "prompt", "tools", "model" } } or @file.json').option("--agent <name>", "Run this session AS that agent (its prompt, tools and model), from .nexrall/agents, a plugin, --agents or a builtin").option("--bare", "Start without discovery: no nexrall.md/memory, skills, plugins, hooks or MCP config files").option("--safe-mode", "Same as --bare (Claude Code's troubleshooting name)").option("--tools <list>", 'Exactly these built-in tools ("Bash,Read,Edit", "default", or "" for none); the rest are removed, not just unapproved').option("--session-id <id>", "Use this id for a NEW conversation (letters, digits, - _), so a script can find it again").option("-n, --name <name>", "Name the conversation; `nex -r <name>` resumes it by that name").option("--fork-session", "With --resume/--continue: branch into a new session instead of continuing the original").option("--fallback-model <name>", "If the main model is overloaded or unreachable, retry the turn once on this model (needs --output-format)").option("--settings <file|json>", "Settings (permissions, hooks\u2026) for this run only: a JSON file or an inline JSON object; merged over the user/project settings").option("--debug-file <path>", "Write the --debug diagnostics log to this file (implies --debug)").argument("[prompt...]", "One-shot prompt \u2014 if omitted, starts interactive mode").action(async (promptParts, options) => {
+  if (!(0, import_code_core21.isAuthenticated)()) {
     console.error("Not logged in. Run: nex auth");
     process.exit(1);
   }
@@ -174261,11 +174938,11 @@ program2.option("-p, --pro", "Use Claude Opus 5.5 (most capable)").option("-t, -
       console.error(st.error);
       process.exit(1);
     }
-    (0, import_code_core21.setSessionSettings)(st.value);
+    (0, import_code_core22.setSessionSettings)(st.value);
   }
   const allowRules = parseToolList(options.allowedTools);
   const denyRules = parseToolList(options.disallowedTools);
-  (0, import_code_core21.setSessionRules)({ allow: allowRules, deny: denyRules });
+  (0, import_code_core22.setSessionRules)({ allow: allowRules, deny: denyRules });
   let budgetUsd;
   if (options.maxBudgetUsd !== void 0) {
     const b = parseBudget(options.maxBudgetUsd);
@@ -174286,7 +174963,16 @@ program2.option("-p, --pro", "Use Claude Opus 5.5 (most capable)").option("-t, -
     }
     maxTurns = t2.value;
   }
-  const headlessErr = checkHeadlessOnly({ outputFormat: options.outputFormat, budget: budgetUsd, noSessionPersistence: options.sessionPersistence === false, maxTurns });
+  let permissionPromptTool;
+  if (options.permissionPromptTool !== void 0) {
+    const t2 = normalizePermissionPromptTool(options.permissionPromptTool);
+    if (!t2.ok) {
+      console.error(t2.error);
+      process.exit(1);
+    }
+    permissionPromptTool = t2.value;
+  }
+  const headlessErr = checkHeadlessOnly({ outputFormat: options.outputFormat, budget: budgetUsd, noSessionPersistence: options.sessionPersistence === false, maxTurns, permissionPromptTool });
   if (headlessErr) {
     console.error(headlessErr);
     process.exit(1);
@@ -174310,8 +174996,8 @@ program2.option("-p, --pro", "Use Claude Opus 5.5 (most capable)").option("-t, -
   }
   let selectedAgent;
   if (options.agent) {
-    const catalogue = (0, import_code_core21.loadAgentTypesWithWarnings)(process.cwd(), extraTypes).types;
-    selectedAgent = (0, import_code_core21.findAgentType)(catalogue, String(options.agent));
+    const catalogue = (0, import_code_core22.loadAgentTypesWithWarnings)(process.cwd(), extraTypes).types;
+    selectedAgent = (0, import_code_core22.findAgentType)(catalogue, String(options.agent));
     if (!selectedAgent) {
       console.error(`Unknown agent "${options.agent}". Available: ${catalogue.map((t2) => t2.name).join(", ")}`);
       process.exit(1);
@@ -174333,7 +175019,7 @@ program2.option("-p, --pro", "Use Claude Opus 5.5 (most capable)").option("-t, -
   }
   let onlyTools;
   if (options.tools !== void 0) {
-    const t2 = parseToolsFlag(options.tools === true ? "" : options.tools, (0, import_code_core21.knownToolNames)());
+    const t2 = parseToolsFlag(options.tools === true ? "" : options.tools, (0, import_code_core22.knownToolNames)());
     if (!t2.ok) {
       console.error(t2.error);
       process.exit(1);
@@ -174475,7 +175161,7 @@ program2.option("-p, --pro", "Use Claude Opus 5.5 (most capable)").option("-t, -
     }
     effort = lvl;
   }
-  await startChatSession({ model, workDir, prompt: prompt2, resume, continueLast: !!options.continue, initialMode: modeRes.mode, lockMode: modeRes.locked, debug: !!options.debug || debugFile !== void 0, debugFile, fallbackModel, maxTurns, onlyTools, newSessionId, sessionName, forkSession: !!options.forkSession, stdinText, stdinFollowUps, showBanner, outputFormat, effort, audit: options.audit, worktree, fullscreen: !!options.fullscreen, strictPermissions: options.permissionMode !== void 0, budgetUsd, appendSystemPrompt, mcpOverride, strictMcp: !!options.strictMcpConfig, systemPrompt: sysPrompt.value, verbose: !!options.verbose, includePartialMessages: !!options.includePartialMessages, agents: agentsParsed.value, selectedAgent: selectedAgent ? { name: selectedAgent.name, prompt: selectedAgent.prompt, tools: selectedAgent.tools, model: selectedAgent.model } : void 0, replayUserMessages: !!options.replayUserMessages, inputFormatWasStreamJson: options.inputFormat !== void 0 && String(options.inputFormat).toLowerCase() === "stream-json", bare: !!(options.bare || options.safeMode), noSessionPersistence: options.sessionPersistence === false, addDirs: addDirs.value, jsonSchema });
+  await startChatSession({ model, workDir, prompt: prompt2, resume, continueLast: !!options.continue, initialMode: modeRes.mode, lockMode: modeRes.locked, debug: !!options.debug || debugFile !== void 0, debugFile, fallbackModel, maxTurns, onlyTools, newSessionId, sessionName, forkSession: !!options.forkSession, stdinText, stdinFollowUps, showBanner, outputFormat, effort, audit: options.audit, worktree, fullscreen: !!options.fullscreen, strictPermissions: options.permissionMode !== void 0, budgetUsd, appendSystemPrompt, mcpOverride, strictMcp: !!options.strictMcpConfig, systemPrompt: sysPrompt.value, verbose: !!options.verbose, includePartialMessages: !!options.includePartialMessages, agents: agentsParsed.value, selectedAgent: selectedAgent ? { name: selectedAgent.name, prompt: selectedAgent.prompt, tools: selectedAgent.tools, model: selectedAgent.model } : void 0, replayUserMessages: !!options.replayUserMessages, inputFormatWasStreamJson: options.inputFormat !== void 0 && String(options.inputFormat).toLowerCase() === "stream-json", bare: !!(options.bare || options.safeMode), noSessionPersistence: options.sessionPersistence === false, addDirs: addDirs.value, jsonSchema, permissionPromptTool });
 });
 program2.parse();
 /*! Bundled license information: